Device Code Authentication Flow Used for Phishing (Entra ID)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•3•0•6

Detects the use of the device code authentication protocol in Azure Sign-in logs, which is a common vector used in Adversary-in-the-Middle (AiTM) phishing attacks to hijack OAuth tokens.