Browser navigation to Microsoft device code auth page via phishing kit

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•5

Detects the initiation of the OAuth 2.0 Device Authorization Grant flow via command-line arguments within standard web browsers. This flow is frequently exploited in phishing campaigns to obtain unauthorized access tokens by tricking users into entering a device code on a malicious or attacker-controlled authorization page.