Multiple threat actors are compromising Microsoft 365 accounts using OAuth device code authorization mechanism. Attackers trick victims into entering a device code on Microsoft's legitimate device login page, unknowingly authorizing an attacker-controlled application and granting access without stealing credentials or bypassing MFA. The attack uses phishing kits including SquarePhish v1/v2 (publicly available red teaming tool targeting OAuth device grant authorization flows via QR codes) and Graphish (malicious phishing kit supporting OAuth abuse, Azure App Registrations, and adversary-in-the-middle attacks). Attack chains involve presenting device codes as one-time passwords or token re-authorization notifications.