Device-Code Phishing: The Real Login Page Trap

Device-code phishing starts with an uncomfortable possibility: the sign-in address you checked really does belong to Microsoft. The document you're expecting comes with a code, the page looks right, and the question that matters is still hiding in the request. Plaintext with Rich follows the approval from the person entering that code to the software waiting on the other end. A television sign-in and a parcel collection slip help explain device-code flow without turning your commute into a technical certification. The episode draws on the Federal Bureau of Investigation's May 21, 2026, Kali365 advisory to unpack how criminals used genuine Microsoft pages in requests for Microsoft 365 access. You'll hear what access tokens and refresh tokens do, why the code you enter connects to a separate pending request, and how multi-factor authentication fits into the picture. There's also a leadership question about whether awareness training shows employees enough legitimate setup activity to recognize a request that doesn't belong. If you handle shared documents, help colleagues with account access, or write security guidance, this is for you. No background in identity systems required, just some curiosity about what a successful sign-in actually approves. Listen for the missing context behind that familiar page. One Topic, Ten minutes, No panic. Is there a topic/term you want me to discuss next? Text me!! YouTube more your speed? → https://links.sith2.com/YouTube Apple Podcasts your usual stop? → https://links.sith2.com/Apple Neither of those? Spotify’s over here → https://links.sith2.com/Spotify Prefer reading quietly at your own pace? → https://links.sith2.com/Blog Join us in The Cyber Sanctuary (no robes required) → https://links.sith2.com/Discord Follow the human behind the microphone → https://links.sith2.com/linkedin Need another way to reach me? That’s here → https://linktr.ee/rich.greene