MFA Won't Save You: How Device Code Phishing Bypasses Your Strongest Authentication6 April 2026·2038 words·10 minsSecurity Operations Phishing Identity Security Cloud Security Detection EngineeringAt least 11 phishing kits now abuse the OAuth device flow to bypass MFA entirely. How the attack works and how to shut it down.