In order to protect against the specific attack vector used by Storm-2372, Microsoft recommends: Disabling device code flow ...

The researchers simplified in the following diagram the attack flow targeting users ... "stolen OAuth authorization code to register a new device to the victim’s Microsoft Entra ID (formerly ...

Microsoft Threat Intelligence warns that ... These include only allowing device code flow where necessary, blocking it where possible, and configuring Entra ID’s device code flow accordingly ...