Device Code, OAuth, PhaaS: How Session Token Theft is Breaking the Phishing Playbook

Episode notes

Your user clicked a link, landed on a real Microsoft login page, typed their password, completed MFA, and walked away thinking nothing happened. Somewhere across the internet, an attacker's device just received an authenticated session token. The password is irrelevant. The MFA prompt already fired and passed. With PhaaS platforms now converging on token-theft tradecraft and post-compromise automation executing in seconds, defenders are racing a scripted attacker with a manual playbook. Join hosts Brandon and John as they discuss: How device code phishing uses real authentication infrastructure to capture valid session tokens How one campaign hit 35,000+ users across 13,000+ organizations in 26 countries Why rogue device registrations complete before the average analyst reads the alert Two questions your organization should be asking right now: Has your Conditional Access policy been reviewed specifically for device code grant flows, not whether CA policies exist, but whether they cover the OAuth flows that session-token theft actually exploits?

• How Hackers Are Using AI Right Now: Faster Attacks, Smarter Malware, and a New Arms Race73 / 100
• Klue, Kali365, OAuth: When the Front Door Is a Trusted Integration
• ShinyHunters' Expanding Toolkit: Oracle PeopleSoft Zero-Day Exploitation and the BreachForums Defense Gaps
• China-Linked Cyber Espionage: How OP-512 Exploited Legacy IIS Servers and Evaded Detection
• SonicWall, MFA Bypass, IABs: Why Patched Devices Are Still Handing Attackers Initial Access