Device-Code or AiTM Authentication Flow Abuse Following Passkey Lure

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects potential abuse of the device-code authentication flow, which is often used in AiTM (Adversary-in-the-Middle) phishing campaigns. The detection looks for device-code authentication attempts followed by specific error codes (50074, 50140) commonly associated with failures in malicious passkey-themed phishing workflows.