Python-requests API abuse shortly after device code auth (GhostCode)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•3

This rule detects potential API abuse by identifying high-frequency API calls using the 'python-requests' user agent that occur within a short time window (120 seconds) immediately following a successful device code authentication event. This behavior is indicative of automated token theft or session hijacking where an adversary attempts to perform unauthorized actions quickly using tokens obtained via device code phishing.