What Is Device Code Phishing?

Device-code phishing is a social-engineering technique described in this report in which attackers request a legitimate service to issue a device code to the attacker’s device, then trick the real user into entering that same code on the legitimate site—thereby binding the attacker’s device to the victim’s account and enabling persistent unauthorized access; the post references Microsoft’s report on a Russian nation-state campaign (Storm-2372), outlines the attack flow and why it defeats typical URL-based phishing checks, and recommends mitigations including disabling device-code flows via conditional access, IP/geo restrictions, and targeted user education.