The era of generic "spray-and-pray" phishing is giving way to something considerably more dangerous: adaptive campaigns that automatically tailor their attack to the specific device, operating system, and identity platform of each victim. Researchers at Cofense and Huntress published findings in late June and early July 2026 documenting how Phishing-as-a-Service (PhaaS) platforms are now embedding AI-driven personalization at industrial scale.
How Adaptive Phishing Works
The mechanism is deceptively simple. When a victim clicks a phishing link, their browser transmits a User-Agent header identifying their operating system, browser, and device type. Traditional phishing pages ignore this data and serve the same content to everyone. Modern adaptive kits use it to:
- Detect the device and OS (Windows, macOS, iOS, Android, Linux)
- Select a matching lure — a Windows target sees a Microsoft 365 credential prompt; an iOS target sees a fake Apple ID page
- Deliver an OS-specific payload — malware, credential stealers, or OAuth token interceptors tuned to the platform
- Generate a unique lure per victim — AI ensures no two phishing emails in the same campaign are identical, defeating signature-based email filters
The EvilTokens campaign, tracked by Huntress, deployed this approach against 344 victim organizations in a single wave — an indication of how scalable PhaaS infrastructure has become.
Device Code Phishing: The Dominant Vector
Cofense's July 1, 2026 research highlights the explosive growth of device code phishing, a technique that exploits the OAuth device authorization flow used by Microsoft 365 and Azure AD. Rather than stealing passwords, attackers trick victims into approving an attacker-controlled OAuth token — granting persistent access to email, SharePoint, and Teams without ever needing the victim's password.
The numbers are alarming:
- Device code phishing attacks increased 1,380% between July–December 2025 and January–April 2026
- 83% of phishing websites now specifically target mobile devices
- Smishing (SMS phishing) accounts for 35% of all phishing activity
- AI agents are beginning to conduct end-to-end social engineering campaigns, including voice cloning for follow-up calls to validate stolen credentials
PhaaS: The Democratization of Sophisticated Attacks
Phishing-as-a-Service platforms are the business model behind this evolution. For a monthly subscription fee — often a few hundred dollars — a threat actor with no technical background can access:
- Pre-built adaptive phishing kits targeting major identity providers
- Automated lure generation powered by AI
- Real-time victim tracking dashboards
- Telegram bot integrations for live OTP interception
- Hosting infrastructure with built-in CAPTCHA and bot detection bypass
The barrier to launching a sophisticated, targeted, device-aware phishing campaign has effectively collapsed. What required a skilled attacker in 2022 can now be done by someone who read a tutorial.
Why Traditional Defenses Are Failing
Legacy email security relies on:
- Signature matching — ineffective when every email is unique
- Domain reputation — newly registered phishing domains have no history
- Attachment scanning — most modern phishing uses no attachments
- URL filtering — adaptive kits rotate infrastructure faster than blocklists update
AI-generated lures are grammatically correct, contextually relevant, and free of the typos and formatting oddities that trained users once relied on to identify phishing. Combined with device-aware adaptation, a phishing email landing in a victim's inbox can look genuinely indistinguishable from a legitimate notification.
Defensive Countermeasures
Against adaptive phishing at this sophistication level, defenders need layered controls that go beyond email filtering:
| Control | Why It Matters |
|---|---|
| FIDO2/passkeys | Device code phishing captures OAuth tokens — passkeys are bound to the legitimate domain and can't be captured |
| Conditional Access policies | Restrict device code flow in Azure AD/Entra ID; require compliant devices |
| User training on OAuth consent | Teach users to reject unexpected OAuth prompts, especially device code requests |
| Token anomaly detection | Alert on OAuth tokens issued to unmanaged devices or from unexpected geolocations |
| SMS/voice MFA hardening | Migrate away from SMS OTP to app-based or hardware authenticators |
The disabling or restricting of the OAuth device code flow in Microsoft Entra ID is the single highest-impact mitigation available to most Microsoft 365 organizations today. Microsoft provides Conditional Access policies for this purpose — if you haven't applied them, this research is your reminder.
The phishing threat has fundamentally evolved. Treating it as a user-awareness problem misses the scale and sophistication of modern PhaaS infrastructure. Adaptive, AI-powered campaigns require adaptive, AI-augmented defenses.