Device Code Flow Authentication Followed by Device Registration

Ankit Mehta@Secvyn

•updated Jun 29, 2026•9•0•15

Detects anomalous device code authentication sessions originating from non-corporate IP addresses using common command-line user agents, which are immediately followed by a device registration event by the same user. This pattern is indicative of OAuth device code phishing, where an attacker tricks a user into authorizing a malicious application to access their account.