The New Hotness in Phishing: Device Code Attacks in M365

Device code phishing attacks exploit legitimate Microsoft authentication flows to stealthily bypass user suspicion and Conditional Access controls, enabling attackers to hijack OAuth tokens and persist in Microsoft 365 environments unless organizations proactively block unnecessary device code flows and revoke compromised tokens.