Storm-2372

Click-time code generation strips the 15-minute limit out of device code phishing

Microsoft's researchers describe a device code phishing campaign that minted fresh codes the moment a target clicked, defeating the expiry that used to hold these attacks down. The flow it abuses is only needed by hardware that cannot show a login page.