Device code phishing: it's phishing with dynamite

Device code phishing — abuse of the OAuth device-code authentication flow to trick users into authorizing attacker-controlled apps — is surging. Researchers report a 15x increase targeting Microsoft 365 users and note that phishing-as-a-service platforms like EvilTokens have industrialized the attack, allowing low-skilled actors to scale account-takeover operations; the article explains the flow, how it is exploited, and why the technique is particularly dangerous.