Microsoft took down a phishing service that used the OAuth device flow to get into 12,000 inboxes without stealing a single password. Here’s what the attack means for teams that offer device-code sign-in.
Device code phishing: How EvilTokens worked and how to stop it
calendar_today
October 1, 2026
domain
workos