GhostCode kit backend polling for device-code authentication completion

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

Detects repeated polling activity against a suspected device code endpoint, common in OAuth 2.0 device authorization grant phishing attacks where an adversary attempts to maintain session persistence or status checks for a stolen device code.