OAuth Device Code Phishing via Non-Browser Process to Microsoft Auth Endpoint

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects automated scripts or command-line utilities initiating connections to Microsoft authentication endpoints using OAuth device code authorization parameters. This behavior is indicative of PhaaS (Phishing-as-a-Service) tools, such as EvilTokens, attempting to perform device code OAuth flows on behalf of an attacker to gain unauthorized access.