EvilTokens Device Code OAuth Polling Loop Token Harvest Detection

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•2

This rule detects EvilTokens device code OAuth phishing by identifying rapid, repeated POST requests to the /common/oauth2/token endpoint with a device_code grant and authorization_pending responses, followed by a successful token issuance and sign-in without an MFA claim. This pattern is consistent with EvilTokens session harvesting.