Tag · 1 article

ThreatDetection

Jun 3, 2026 · 8 min read

OAuth Device Code Flow Security: How to Detect and Prevent Device Code Phishing

OAuth device code phishing (RFC 8628 abuse) bypasses MFA and steals M365 refresh tokens without a password. Learn how to disable device authorization grant in Entra ID, Keycloak, Auth0, and detect attacks with SIEM rules.