MadApe: a new phishing kit steals Microsoft 365 accounts without stealing a password
Attackers abuse Microsoft's "device code" mechanism, meant for connecting TVs and printers, to get victims to grant them access themselves. Even two-factor authentication doesn't stop it.