indicatorurl
/api/device/start
- First seen
- 2026-05-13
- Last seen
- 2026-05-14
- Sightings
- 1
Posts referencing this indicator
- New widespread EvilTokens kit: device code phishing as-a-service – Part 1
EvilTokens backend API endpoint used to initiate the device code flow and fetch the user code.