Device Code Phishing:

A new sophisticated cyberattack that exploits a legitimate login process used by trusted services like Microsoft and Google. It tricks users into granting account access to attackers – often without realizing it – by using real login pages and trusted domains.

Because it bypasses multi-factor authentication and looks completely legitimate, this type of attack is especially hard to detect and highly effective.