⚠️ Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse

"Construction bid lures, landing page code generation, DocuSign impersonation, voicemail notifications, and abuse of Microsoft Forms pages are all hitting the same victim pool through the same https://Railway.com IP infrastructure."

https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html

#microsoft365 #infosec #oauth