---
id: 6400
title: "Device Code Phishing: Technical Analysis and Proactive Hunting via Netlas"
source_domain: netlas.io
source_url: "https://netlas.io/blog/device_code_phishing/"
published_at: "2026-05-28T00:00:00Z"
tags: ["threat-hunting", "phishing", "oauth", "token-theft", "netlas", "device-code-phishing"]
phying_url: "https://phying.com/item/6400"
lang: en
---

# Device Code Phishing: Technical Analysis and Proactive Hunting via Netlas

## Summary

Device-code phishing abuses the OAuth RFC 8628 flow: victims enter codes on genuine Microsoft pages while tokens land with attackers — plus template comparisons and Netlas hunting patterns.

## Intelligence Metadata

- **Sources:** netlas.io
- **Published:** 2026-05-28T00:00:00Z
- **Original:** https://netlas.io/blog/device_code_phishing/
- **Phying News:** https://phying.com/item/6400