{"success":true,"data":{"id":"oauth-device-code-phishing-lure","label":"OAuth device code phishing — microsoft.com/devicelogin or Google device URL + code prompt (Storm-2372 / EvilTokens PhaaS)","description":"Email directs the recipient to microsoft.com/devicelogin or google.com/device with a short alphanumeric code — the hallmark of OAuth Device Code Authorization phishing. Unlike URL-harvest phishing, these attacks often contain no malicious link: the vector is the victim pasting an attacker-generated code into the genuine Microsoft/Google login page, granting the attacker a persistent OAuth token. Proofpoint Feb-Dec 2025 tracked 10+ campaigns; Microsoft MSRC attributed Storm-2372 nation-state activity to this technique; Unit 42 confirmed 340+ M365 organizations compromised across 5 countries in March 2026. Successful exploitation = full mailbox, OneDrive, Teams access with refresh tokens.","tier":"danger","category":"phishing","isThin":false}}