DEBULL Broker Device-Code Poll Request (poll_auth_broker_token)

Duo Tech@duotech

•updated Jul 9, 2026•0•0•8

Detects HTTP POST requests containing 'poll_auth_broker_token' and 'device_code' parameters, which are characteristic of malicious OAuth 2.0 device authorization grant flows commonly used in phishing campaigns.