Wazza Adobe-themed OAuth Device Code phishing landing chain

Arnold Chan@slaz

•updated 19 days ago•3•0•7

Detects potential AiTM or credential harvesting campaigns where a device visits known lure or redirect paths (such as specific domains or workers.dev paths) and subsequently accesses the Microsoft device code authentication page within a 15-minute window.