Device Code Phishing Forensics: What We Learned Investigating BEC in the Wild (opens in new tab)

Device code phishing is scaling fast. We investigated real BEC cases to show how attackers abuse Microsoft’s login flow, why forensics get tricky, and how defenders can detect, block, and investigate these attacks in Entra ID, Sentinel, Conditional Access, and the browser.