Device-Code Phishing Campaign Targets Microsoft 365 via Collaboration Lures

A phishing campaign from late June to early July 2026 abused Microsoft's device-code flow to hijack M365 accounts, using collaboration-themed lures to trick users into legitimate Microsoft login pages. ZeroBEC researchers found the attack did not rely on fake password pages, instead pushing victims through the official device login experience. The campaign targeted multiple organizations, though the full scope remains under investigation.