OAuth Device Code Phishing via microsoft.com/devicelogin

Ibrahim Saud@tektrix

•updated Jun 30, 2026•6•0•19

Detects potential OAuth device code phishing attacks by identifying HTTP requests to the legitimate microsoft.com/devicelogin URL containing suspicious user_code or device_code parameters. This pattern indicates an adversary is using an OAuth device authorization grant flow to steal tokens or gain unauthorized access without the victim needing to provide credentials directly to the attacker.