Device code phishing: How EvilTokens worked and how to stop it

Microsoft took down a phishing service that used the OAuth device flow to get into 12,000 inboxes without stealing a single password. Here's what the attack means for teams that offer device-code sign-in.