Episode
Device Code, OAuth, PhaaS: How Session Token Theft is Breaking the Phishing Playbook
- Published
- May 27, 2026
- Duration seconds
- 1762
- Processing state
not_requested
Actions
POST https://stenobird.com/v1/public/podcasts/shadowtalk-powered-by-reliaquest-61547/episodes/device-code-oauth-phaas-how-session-token-theft-is-breaking-the-phishing-playbook/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/device-code-oauth-phaas-how-session-token-theft-is-breaking-the-phishing-playbook.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
Your user clicked a link, landed on a real Microsoft login page, typed their password, completed MFA, and walked away thinking nothing happened. Somewhere across the internet, an attacker's device just received an authenticated session token. The password is irrelevant. The MFA prompt already fired and passed. With PhaaS platforms now converging on token-theft tradecraft and post-compromise automation executing in seconds, defenders are racing a scripted attacker with a manual playbook. Join ...