P.01Device Code Phishing Is Beating MFA. Here's How EvilTokens Does It
EvilTokens is a phishing-as-a-service kit abusing OAuth's device code flow, and it doesn't need a fake login page to work. Here's how the attack actually runs and the Conditional Access policy that stops it.
