N0va: Refresh Token Issuance After Device Code Grant Flow

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•5

Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.