Device code phishing bypasses password stealing

This report details an active Microsoft 365 "device code" phishing campaign that tricks corporate users into authorizing attacker-controlled devices via the legitimate OAuth Device Authorization Grant flow; it covers the email lure, landing-page code (use of invisible Unicode chars and automated device-code beaconing), network detection patterns, a YARA rule to detect landing pages, and a large list of IoC URLs, and provides detection and mitigation recommendations.