OAuth Device Code Phishing Leading to Primary Refresh Token Issuance

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•2

Detects a potential OAuth device code phishing abuse pattern where an authenticated device code sign-in is immediately followed by a new device registration or Primary Refresh Token (PRT) issuance for the same user, potentially originating from a different device or IP address.