OAuth Device Code Authorization Flow Abuse (GhostCode Phishing)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•2

This rule monitors network connections and DNS queries directed towards Microsoft's OAuth device code authorization endpoints ('/common/oauth2/deviceauth' or '/device'). This flow is frequently abused by adversaries to perform device code phishing, allowing them to gain access to a victim's account without requiring the user's password or bypassing traditional MFA.