When legit is the trick: Phishing’s sneaky new moves.

*Executive summary:* This podcast episode outlines how attackers are increasingly abusing legitimate Microsoft workflows — notably device code phishing that tricks users into completing real OAuth logins (granting attackers valid access tokens) and Microsoft 365 Direct Send to make phishing emails appear to originate from inside organizations — reflecting a broader shift toward weaponizing built-in cloud services instead of relying on obviously malicious infrastructure.