Tag · 2 articles

Microsoft365

Jun 3, 2026 · 8 min read

OAuth Device Code Flow Security: How to Detect and Prevent Device Code Phishing

OAuth device code phishing (RFC 8628 abuse) bypasses MFA and steals M365 refresh tokens without a password. Learn how to disable device authorization grant in Entra ID, Keycloak, Auth0, and detect attacks with SIEM rules.

May 18, 2026 · 6 min read

Tycoon 2FA Returns With OAuth-Based Phishing to Bypass Microsoft 365 Security

Tycoon 2FA uses OAuth-based phishing to bypass Microsoft 365 security. Learn how to protect your organization from this emerging threat.