Additionally, if you suspect device code phishing, revoke the user's refresh tokens and also consider setting a conditional access policy to force re-authentication for users.

It exploits “device code flow,” a form of authentication formalized in the industry-wide OAuth standard. Authentication through device code flow is designed for logging printers, smart TVs ...