A Russia-aligned threat group uses Microsoft 365 device code phishing to steal credentials and take over accounts, tracked since September 2025.