Best Detection of 2026 Series: OAuth Device-Code and ConsentFix Illicit Consent

Ibrahim Saud@tektrix

•updated Sep 28, 2026•4•0•4

Detects a suspicious sequence where a user completes a device-code authentication flow followed shortly by consenting to high-risk OAuth permissions. This pattern is characteristic of consent phishing and device-code phishing attacks, where an attacker leverages these methods to gain persistent access to a user's cloud resources via malicious application tokens.