Device Code Phishing Attacks Surge 37x as New Kits Spread Online

Device Code Phishing Explodes in 2026

A phishing technique that exploits a legitimate feature of the OAuth 2.0 Device Authorization Grant flow has seen a 37-fold increase in attack volume in 2026, according to new research. The surge is being driven by the widespread distribution of ready-to-deploy phishing kits on underground forums, dramatically lowering the barrier to entry for threat actors who lack the technical expertise to build their own tooling.

What Is Device Code Phishing?

The OAuth 2.0 Device Authorization Grant (RFC 8628) is a legitimate authentication flow originally designed for devices with limited input capability—smart TVs, printers, IoT devices—that cannot easily display a full browser-based login prompt. The flow works as follows:

1. The device requests a short-lived user code and a device code from the identity provider (e.g., Microsoft Entra ID / Azure AD)
2. The user is instructed to visit a verification URL (e.g., microsoft.com/devicelogin) on a separate device
3. The user enters the user code and authenticates normally, including completing MFA
4. The original device polls the token endpoint and, upon successful authentication, receives a full access token and refresh token

In a device code phishing attack, the attacker generates this code themselves and tricks the victim into entering it at the legitimate identity provider URL. Because the victim authenticates against the real Microsoft (or Google, Okta, etc.) login page—including their MFA step—traditional phishing defenses that check for lookalike domains provide no protection. The attacker simply polls the token endpoint and collects long-lived OAuth tokens once the victim authenticates.

Why the 37x Surge?

Researchers attribute the explosive growth primarily to the commoditization of the technique through packaged phishing kits. These kits:

• Automate device code generation and polling — the attacker simply pastes a victim's email and the kit handles the rest
• Include pre-built lure templates — convincing Microsoft Teams notifications, SharePoint document shares, and Azure portal alerts that prompt victims to enter the device code
• Integrate with Telegram bots — stolen tokens are automatically forwarded to attacker-controlled channels in real time
• Bundle token refresh logic — ensuring stolen sessions remain valid for weeks or months, not just hours

Several kit variants have been documented selling for as little as $150–$400 on underground markets, putting enterprise account takeover within reach of financially motivated criminals who previously lacked the technical skills.

Attack Campaigns Observed

Multiple distinct campaigns leveraging device code phishing have been observed targeting:

• Microsoft 365 and Azure tenants — attackers use the stolen tokens to access email, Teams, SharePoint, and Azure management APIs
• Government and defense contractors — spear-phishing lures reference classified document access or security compliance notifications
• Financial services firms — lures mimic wire transfer approval workflows or compliance portal authentication requests
• Energy and utilities sector — themed around SCADA or industrial control system portal access

Once an attacker holds a valid refresh token, they can maintain persistent access even if the victim changes their password, because OAuth refresh tokens are typically not revoked on password reset unless the organization has configured conditional access policies to do so.

Detection and Defense

For Security Teams

• Monitor for device code authentication flows in your identity provider logs — Azure AD Audit Logs and Sign-In Logs record device code grant events; alert on any that originate from unfamiliar device IDs or geographies
• Restrict the Device Code flow via Conditional Access — Microsoft Entra ID allows organizations to block or limit device code authentication to specific trusted device types
• Deploy token revocation workflows — ensure that on suspicious sign-in detection, refresh tokens are immediately revoked rather than relying solely on short token lifetimes
• Enable Continuous Access Evaluation (CAE) — Microsoft's CAE framework allows near-real-time revocation of access tokens when risky conditions are detected

For End Users

• Never enter a device code in your browser unless you initiated a device pairing yourself — legitimate enterprise services will not ask you to authenticate a device you didn't initiate from a physical device in front of you
• Be skeptical of unsolicited Teams messages, emails, or notifications asking you to go to any login or verification URL
• Report suspicious authentication prompts to your security team immediately rather than completing them

Organizational Controls

1. Block legacy OAuth flows — Device Code, ROPC (Resource Owner Password Credentials), and other non-interactive flows should be explicitly blocked for user accounts unless required for legitimate IoT or kiosk deployments
2. Implement phishing-resistant MFA — FIDO2 / Passkeys are not directly defeated by device code phishing since the authentication still occurs at the real IdP; however, combined with Conditional Access restrictions on the Device Code flow, this significantly reduces exposure
3. Deploy a CASB or identity threat detection solution that correlates OAuth token usage patterns across your SaaS estate

Key Takeaway

Device code phishing is dangerous precisely because it weaponizes a legitimate authentication flow and succeeds even when the victim completes real MFA. The technique does not require lookalike domains, malware delivery, or credential harvesting in the traditional sense—it abuses trust. With the 37x surge in 2026, organizations that have not yet restricted the OAuth Device Code Grant flow in their identity provider policies should treat this as an urgent configuration hardening task.

References

• BleepingComputer — Device code phishing attacks surge 37x as new kits spread online
• Microsoft — Block device code flow with Conditional Access
• RFC 8628 — OAuth 2.0 Device Authorization Grant