Possible M365 Account Compromise via Device Code Phishing Campaign
Possible compromise of Microsoft 365 account {{RecipientEmailAddress}} following a device code phishing campaign leveraging microsoft.com/devicelogin to obtain OAuth tokens from an attacker-controlled session.
Microsoft Sentinel (KQL)
