By Dimitris Statheros, L2 SOC Analyst and Nikolaos Marinopoulos, L2 SOC Analyst
Every October, Cybersecurity Awareness Month reminds us that no single product keeps an organization safe. Protection comes from three disciplines working together: intelligence on adversaries, detection engineering and the daily work of the Security Operations Center. Device code phishing shows why, as it needs neither a fake login page nor a stolen password.
Awareness as a Security Principle
Attackers increasingly turn legitimate, trusted features into weapons, and no technical control can fully replace a user who stops to question an unexpected request. Awareness is therefore a security principle in its own right: people who understand that a familiar brand, a legitimate URL, or a routine prompt does not guarantee safety become an active layer of defense. Organizations should make it easy to report anything unusual and treat every request for access as something to verify rather than assume.
Threat Detection Research
Indicator-based detection remains a useful baseline, but it cannot detect attacks that abuse legitimate services. In device code phishing, the sign-in happens on a genuine Microsoft page, so there is no malicious URL, file or lookalike domain to match.
Our research therefore focuses on identity telemetry: which Entra ID sign-in fields, such as the authentication protocol, the client application, and the IP addresses associated with authentication and subsequent token use, help distinguish an attacker’s session from normal activity. We enrich these rules with IoCs and infrastructure from current phishing kits.
We reproduce each technique in a controlled lab environment to identify the log artifacts it generates, then test our detection rules against legitimate device code authentication scenarios to minimize false positives.
Security Operations Center Procedures
Our SOC is built to adapt as quickly as the threat landscape evolves. Beyond continuous monitoring, threat hunting and response, we rapidly translate emerging intelligence into updated detection rules, investigation procedures and response playbooks. Agentic AI further enhances our capabilities by supporting autonomous investigation, correlating signals across security data and accelerating the transition from detection to response. Automated threat intelligence enrichment across our SIEM and SOAR platforms, combined with continuous training and knowledge sharing, enables our analysts to respond with speed, context and consistency. This turns new threats into actionable improvements rather than waiting for them to become incidents.
“Device Code” Case Study
In April, Microsoft reported a widespread campaign that turned the OAuth device code flow, built for TVs and printers without a regular sign-in screen, against its users. Storm-2372 used it against selected targets in early 2025, and criminal kits such as EvilTokens have since put it within anyone’s reach. By spring 2026, Microsoft reported 10 to 15 new campaigns launching each day. Stolen tokens have been used to read mail, spread more phishing and enroll attacker-controlled devices.
ADACOM’s Response
During Microsoft Entra ID telemetry analysis, ADACOM’s Security Analyst Team identified an intrusion leveraging the OAuth 2.0 Device Authorization Grant. By correlating sign-in events and token activity, they detected a device code authentication approved from a corporate endpoint, followed by token use from an unfamiliar, unmanaged external IP.
Our SOC quickly converted the newly identified attack pattern into actionable detection rules and indicators of compromise (IoCs), followed by a retrospective threat hunt across client environments. This enabled us to quickly identify exposed infrastructure, proactively notify affected clients and implement targeted mitigation measures, demonstrating our ability to turn emerging threats into immediate defensive action.