EvilTokens OAuth Device Code Token Theft Enabling M365 BEC and Data Exfiltration

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•10

Detects signs of a session hijacking attack using the OAuth device code grant flow, specifically identifying the initial device code authorization followed by suspicious post-authentication activity like mass data access via Microsoft Graph API or the creation of mailbox forwarding rules.