N0va-style device code authentication phishing abuse

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•4

Detects anomalous activity associated with OAuth 2.0 device code phishing campaigns. The rule identifies accounts showing frequent device code authentication attempts, including successful logins from potentially unmanaged or unrecognized devices, which is consistent with the behavior of phishing kits targeting OAuth device grant flows.