GhostCode attackers hijack Microsoft 365 accounts with device codes
Microsoft 365 users are being tricked into handing over access to their accounts by a new phishing kit, GhostCode, that exploits a weakness in a legitimate device authorization flow. Researchers…