OAuth Device Code Phishing Campaigns Surge Targets Microsoft 365

**Executive Summary:** A surge of phishing campaigns is exploiting Microsoft’s OAuth device code authorization flow to trick users into approving malicious applications and grant attackers access tokens for Microsoft 365 account takeover; campaigns use QR codes, embedded buttons/links and phishing kits (SquarePhish2, Graphish) and include financially motivated actors (TA2723) and Russia-aligned groups (UNK_AcademicFlare) targeting government, academic, transportation and other sectors.