Device Code Phishing: Prevention, Detection and Response
How device code phishing works, what Microsoft detects by now, and what you still have to build yourself.
The trigger for this post is the session “The 2026 state of advanced identity attacks” that I presented together with Eric Woodruff at the Workplace Ninja Summit 2026 in September. The idea behind it: whenever one of these attacks makes the news, the same questions come up (are we vulnerable? has Microsoft fixed this? how likely is it really?), and a few weeks later they are forgotten because day-to-day business continues.
