Device code phishing: it's phishing with dynamite

Device code phishing — where attackers abuse the OAuth device code grant to induce users to authorize malicious clients — is rapidly increasing and being industrialized. Researchers report a ~15x rise in attacks targeting Microsoft 365 and note threat actors pivoting to this technique, enabled at scale by services like EvilTokens which lower the skill barrier and automate lures and evasion.