Non-Windows User-Agent Sets x-ms-RefreshTokenCredential Cookie on login.microsoftonline.com

Smarth Arora@smarthxarora

•updated Jul 6, 2026•0•0•1

Detects the presence of the 'x-ms-RefreshTokenCredential' cookie in requests directed to 'login.microsoftonline.com' originating from a client that does not identify as Windows. This behavioral pattern is associated with session hijacking techniques where an attacker uses a tool (e.g., Device Code Lab) to inject a session cookie into a browser, allowing for unauthorized access to Microsoft 365 services.