We've had several near-breaches involving an EvilToken-style attack. A compromised account sends convincing messages to everyone in the victim's address book, often linking to a legitimate-looking SharePoint site.…
Microsoft's reporting on device-code phishing highlights an awkward security tradeoff: device-code authentication is legitimate, but attackers can abuse it by persuading users to authorize a session on another…
We've seen device-code phishing attacks where an attacker uses an OAuth token to register a rogue device in Entra ID and obtain a Primary Refresh Token (PRT). Because…
We've been investigating device-code phishing attacks where an attacker authenticates through a device-code flow, obtains OAuth tokens, and then registers or joins a rogue device to Entra. The…
Microsoft's recent guidance on device-code phishing highlights an awkward problem: device-code authentication is legitimate, but attackers can abuse the trusted flow by persuading users to authorize a session.…