Couldn’t decide whether to put this in Threat Intel or here, but since the “intel” is mostly Microsoft-specific recommendations for configuration, I’m dropping it here. Nevertheless, this is a detailed explanation of the “EvilTokens” service and campaign.
Disabling device code flows in Entra environments should be considered a best practice, except for very aggressively CAPed use cases.
