AiTM Device-Code Phishing: MS Devicelogin Request from Non-MS Referrer

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•3

This rule detects HTTP requests to the Microsoft device login endpoint (/devicelogin) that originate from a non-Microsoft referrer domain. This behavior is highly indicative of Adversary-in-the-Middle (AiTM) phishing attacks targeting OAuth device code flows, where a malicious proxy site redirects users to the legitimate Microsoft login page while attempting to capture session tokens.