CAPTCHA-gated redirect chain preceding device code login (EvilTokens)

Arnold Chan@slaz

•updated Sep 23, 2026•3•0•5

Detects a specific adversarial pattern used to bypass authentication protections, where a browser process first navigates to an attacker-controlled identity verification or CAPTCHA challenge page, followed by an immediate navigation to legitimate Microsoft device code authentication endpoints within the same process session.