Device Code Phishing: Why It's 2026's Fastest-Growing Threat

Device code phishing, the abuse of the OAuth 2.0 device authorization grant to hijack access tokens, has escalated from a niche red-team technique into an industrial-scale threat inside six months. Originally designed for input-constrained devices like smart TVs and printers, the device authorization flow has been bolted onto a wide range of apps and CLI login use cases it was never intended for. Researchers first documented the vector in 2020, but real-world adoption only took off in 2024 when nation-state group Storm-2372 began deploying it. By 2025, ShinyHunters was leveraging device code phishing against Salesforce tenants at scale. In February 2026, the EvilTokens kit launched and criminal adoption skyrocketed. Microsoft now reports 10 to 15 entirely new campaigns every 24 hours, Barracuda counted 7 million attacks in four weeks, and the FBI issued a standalone advisory on the Kali365 phishing-as-a-service kit, the first US federal PSA dedicated to a specific PhaaS platform.

The technique defeats every form of MFA, including passkeys, hardware security keys, and enforced phishing-resistant authentication. Device code phishing does not attack the login flow itself; it attacks the authorization layer that follows. In most cases, the victim is already authenticated to their Microsoft account when they encounter the phishing page. They copy a short code, paste it into the legitimate Microsoft device login page, select their account from a dropdown, and click allow, completing the compromise in seconds. Security teams should verify credential exposure with an email breach checker and audit session hygiene with a privacy checkup, but the core problem is architectural: proving identity and granting application access are two distinct steps, and most controls only protect the first.

The PhaaS ecosystem has fully industrialized device code phishing. It is no longer a specialist skill; it is a standard line item in phishing-as-a-service catalogs. Tycoon2FA, previously the most widely deployed AiTM phishing kit, added device code phishing to its framework in May, while Kali365 bundles AiTM and device code phishing into a single platform. Push Security's Browser & Identity Attacks Matrix now tracks more than 25 distinct device code phishing kits in the wild. Defenders should rotate credentials, validate account integrity using a password checker, and re-examine OAuth scopes granted across the tenant, because in the second half of 2026 there is no sign the pace is slowing.