Microsoft 365 Device Code Phishing Campaign Bypasses Password Theft With Legitimate Login Flow

This report enumerates dozens of URLs identified as phishing kit landing pages that leverage Microsoft device-code and Live authentication endpoints (e.g., login.microsoftonline.com, aka.ms/devicelogin) to phish credentials; it additionally lists a YARA rule (DeviceCode_Phishing_LandingPageHTML) used to detect these landing pages. The collection indicates an active phishing campaign abusing legitimate auth flows to harvest credentials and provides IOC data for detection and blocking.