OAuth Device Code Phishing Sign-In Leading to Cloud Identity Compromise

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects sign-in activity using the OAuth 2.0 device code flow, followed by subsequent authentication attempts from the same account originating from anomalous, previously unseen geographic locations or using unfamiliar applications. This pattern is indicative of a device code phishing attack where an adversary lures a user into authorizing a malicious device or application and subsequently hijacks the resulting session to access resources from a different location.