# Device Code, OAuth, PhaaS: How Session Token Theft is Breaking the Phishing Playbook

Page: https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/device-code-oauth-phaas-how-session-token-theft-is-breaking-the-phishing-playbook
Text version: https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/device-code-oauth-phaas-how-session-token-theft-is-breaking-the-phishing-playbook.md
Podcast: [ShadowTalk: Powered by ReliaQuest](https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547)
Published: 2026-05-27T20:00:00+00:00
Episode link: https://www.buzzsprout.com/2154459/episodes/19250649-device-code-oauth-phaas-how-session-token-theft-is-breaking-the-phishing-playbook.mp3
Audio file: https://www.buzzsprout.com/2154459/episodes/19250649-device-code-oauth-phaas-how-session-token-theft-is-breaking-the-phishing-playbook.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/shadowtalk-powered-by-reliaquest-61547/episodes/device-code-oauth-phaas-how-session-token-theft-is-breaking-the-phishing-playbook
Duration seconds: 1762

## Resource

Your user clicked a link, landed on a real Microsoft login page, typed their password, completed MFA, and walked away thinking nothing happened. Somewhere across the internet, an attacker's device just received an authenticated session token. The password is irrelevant. The MFA prompt already fired and passed. With PhaaS platforms now converging on token-theft tradecraft and post-compromise automation executing in seconds, defenders are racing a scripted attacker with a manual playbook. Join ...

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/shadowtalk-powered-by-reliaquest-61547/episodes/device-code-oauth-phaas-how-session-token-theft-is-breaking-the-phishing-playbook/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/device-code-oauth-phaas-how-session-token-theft-is-breaking-the-phishing-playbook.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.