Skip to main content

Pricing
Blog

Back to all posts

Tag

#token-theft

1 article

$Abstract dark illustration of a glowing authentication code fracturing into token shards drifting toward a shadowed terminal$

Device Code Phishing: How OAuth Token Theft Bypasses MFA (and How to Detect It)

Device code phishing steals OAuth tokens after the victim passes MFA. Learn how the attack works and the Entra log signals that expose it.

Astrid LindqvistAug 17, 202611 min read

Advance your SOC skills

Weekly threat intel, analyst tips, and platform updates.

Email address

No spam. Unsubscribe anytime. Privacy Policy

Real-world security operations. Simulated.

Twitter LinkedIn Discord

Product

Pricing
Shift Mode
Operations
Compare Platforms

Training

SIEM Training
XDR Training
Firewall Training
Browse Operations
Learning Tracks

Learn

Investigation Playbooks
MITRE ATT&CK® Techniques
Cybersecurity Glossary
Career Paths
Blog

Company

Pricing
CareersHiring
Research
Contact

Legal

Privacy Policy
Terms of Service
Cookie Policy
GDPR
DPA
Subprocessors

© 2026 SOCSimulator LLC. All rights reserved.

Made with