OAuth Device Code Flow Phishing via romnor[.]ca Client ID d3590ed6

Tim Peck@timpeck

•updated Jul 13, 2026•1•0•20

This rule detects potential OAuth Device Code Flow phishing attacks where users are directed to malicious lure pages on romnor[.]ca to enter a Microsoft device code. It also alerts on authentication activity associated with a specific malicious OAuth client ID (d3590ed6-52b3-4102-aeff-aad2292ab01c) known to be used by a phishing backend to poll and claim OAuth tokens.