practitioner identity IR phishing
Device-code phishing
Victim completes a real Microsoft (or other IdP) device-code login for an attacker-controlled client. No fake password form required. Pair with AiTM and helpdesk-impersonation playbooks.