Defending the Authentication Flow: Device Code Phishing with Selena Larson

This report discusses the operational mechanics and rising commercialization of device-code phishing campaigns that abuse Microsoft OAuth workflows to harvest credentials and perform account takeovers; it notes leaked phishing kit source code in late 2025 that has democratized sophisticated identity attacks and offers concrete defensive measures (conditional access policies, strict device compliance) to mitigate unauthorized authentication and lateral pivoting through trusted supplier networks.