Not every phishing attack asks you to type your password into a fake website.
Microsoft documented 2026 campaigns that abused device-code authentication flows as part of identity-compromise attacks.
The basic social-engineering problem is straightforward: the victim is persuaded to enter or approve a code as part of what appears to be a legitimate sign-in or account-verification process.
The authentication page itself can be genuine. The problem is that the person being authorised may not be the person the victim thinks they are helping.
That makes device-code phishing particularly useful for attackers because the victim can believe they are completing a normal authentication step.
The practical rule is to never approve an authentication request you did not initiate.
If an unexpected caller, message or email tells you to enter a code, stop. Verify the request through a trusted channel.
Authentication prompts are not proof that the person asking you to approve them is legitimate.