When the Login Page Is Real: The Device-Code Phishing Playbook Targeting Microsoft Accounts

A legitimate Microsoft sign-in path built for low-input devices is being repurposed as a phishing lure, shifting the attack from password theft to trusted-session abuse.