**Device Code Phishing: The Silent OAuth Threat Bypassing MFA**
Device code phishing, a tactic that exploits the OAuth 2.0 device authorization grant, has rapidly evolved from a niche red-team strategy into a large-scale industrial threat within just a few years. Designed for input-constrained devices like smart TVs and printers, the device authorization flow was never meant to handle the breadth of use it now sees—most notably, CLI logins. Researchers first warned about this attack vector in 2020, but it wasn’t until 2024 that nation-state groups such as Storm-2372 began weaponizing it in real-world operations. By 2025, ShinyHunters had launched large-scale attacks against Salesforce tenants using the technique, and by February 2026, the notorious EvilTokens kit had pushed criminal adoption to new heights. Microsoft reported 10 to 15 new device code phishing campaigns every single day in April 2026, with Barracuda detecting 7 million attacks in just four weeks. The FBI even issued a rare advisory on Kali365, marking the first time a U.S. federal agency warned specifically about a phishing-as-a-service kit.
Push Security added device code phishing to its Browser & Identity Attacks Matrix back in 2023 and now tracks more than 25 distinct kits in the wild—and that number continues to grow. As we move into the second half of 2026, the pace shows no sign of slowing.
In a recent deep-dive webinar, Push Security explored the mechanics of device code phishing, demonstrated a custom-built phishing kit, and outlined what organizations need to prepare for next. Here are six critical takeaways security teams should be aware of.
—
### 1. It Defeats Every Form of MFA, Including Passkeys
Device code phishing does not target the login process itself—it targets the authorization step that follows. In most cases, the victim is already signed into their Microsoft account when they encounter the phishing page. They simply copy a short device code, paste it onto the legitimate Microsoft device login screen, select their account, and approve the request.
Because this flow operates outside of traditional authentication, even phishing-resistant MFA methods such as passkeys and hardware security keys offer no protection. The attack exploits a key architectural flaw: proving your identity is not the same as granting an application access. Most security tools focus on the former and leave the latter dangerously exposed.
—
### 2. The PhaaS Ecosystem Has Fully Industrialized
Device code phishing is no longer a specialized tactic—it is now a standard feature in phishing-as-a-service (PhaaS) kits. Tycoon2FA, once identified as the most common AiTM phishing kit, added device code support in May. Kali365 now offers both AiTM and device code phishing through a single platform.
While some analysts point to structural similarities between kits as evidence of fragmentation, Push Security’s research suggests that many kits independently converge on similar designs due to shared LLM-generated code. The tooling has become faster, cheaper, and more accessible.
Modern kits also include advanced capabilities such as persistent persistence mechanisms (e.g., PRT), mailbox access, business email compromise (BEC) automation, and SharePoint exfiltration—all marketed as product features to subscription-based cybercriminals.
—
### 3. Attackers Are Vibe-Coding New Kits Faster Than Defenders Can Track Them
Push Security now tracks over 25 unique device code phishing kits—a dramatic increase compared to just a few years ago. In prior years, a new AiTM kit might appear only once every few months. Today, dozens emerge within a single year.
Much of this acceleration is driven by AI-assisted development. Many kits share nearly identical layouts and code structures because they were generated in response to similar prompts. To demonstrate how easily these kits can be created, Push Security engineer Luke Jennings built a fully functional device code phishing kit during a live demonstration.
—
### 4. It’s Not Just a Microsoft Problem
Although 99% of device code phishing activity observed by Push targets Microsoft, this is not due to any technical limitation of the attack. The OAuth 2.0 device authorization grant is a cross-platform standard supported by a wide range of services.
Nation-state actors have already used the technique against Salesforce, compromising over 1,000 organizations and contributing to one of the largest data breaches in history. Other platforms that support device code flows—including GitHub, AWS, and others used heavily by developers and CLI tools—are equally at risk.
—
### 5. It’s Part of a Broader Shift Toward Authorization Attacks
Device code phishing is one example of a larger trend: attackers are increasingly targeting authorization mechanisms rather than authentication itself. Defenses have historically focused on preventing initial access, leaving post-login authorization poorly protected.
This shift is already evident in other techniques, such as ConsentFix—a browser-based OAuth consent phishing method tied to Russian threat actors that also bypasses MFA by abusing already-established sessions. As attackers refine these methods, organizations must broaden their security focus beyond identity verification.
—
### 6. Detection Must Happen Where the Attack Happens
Device code phishing pages can be delivered via virtually any channel—email, messaging apps, social media, or compromised websites. The victim, however, submits the code directly on the legitimate provider’s domain, meaning traditional email gateways, proxies, and URL reputation systems cannot detect or block the attack.
While conditional access policies can limit device code usage in Microsoft environments, they are not always practical—especially in large organizations where developers rely on these flows for legitimate workflows. Similar limitations exist across other platforms.
Because the phishing lure and the device approval step occur in different environments, the most effective detection happens in the browser. Push Security’s agent-based approach monitors behavioral patterns associated with device code phishing and malicious authorization approvals, rather than relying on static indicators that quickly become obsolete.
—
### FAQ
**Q: What is device code phishing?**
Device code phishing is a type of OAuth phishing that exploits the device authorization grant flow. Victims are tricked into visiting a malicious site, entering a code provided by the attacker, and approving access to a legitimate service—effectively handing over account control without needing to steal credentials.
**Q: Why is this attack so dangerous?**
It bypasses most multi-factor authentication (MFA) methods, including hardware keys and passkeys. It also does not require the attacker to host a fake login page, since the victim completes the process on the real provider’s site.
**Q: Which services are vulnerable?**
Any platform that supports OAuth 2.0 device authorization flows is potentially vulnerable. This includes Microsoft, Google, GitHub, AWS, and many enterprise cloud services.
**Q: How can organizations defend against this?**
Restricting device code flows via conditional access is a starting point, but not always feasible. Browser-level visibility and behavioral detection are essential, as they can identify malicious authorization actions regardless of the target platform.
**Q: Are only Microsoft accounts being targeted?**
While Microsoft is currently the most common target, attackers have already demonstrated the ability and intent to move toward other platforms, especially where device code authentication is widely used.
—
### Conclusion
Device code phishing represents a paradigm shift in OAuth abuse. By decoupling authentication from authorization, it sidesteps nearly every traditional security control. As tooling becomes more accessible and automated, these attacks will continue to appear at unprecedented scale and speed. Defending against them requires a fundamental rethinking of security strategy—emphasizing behavioral detection in the browser, continuous monitoring of authorization flows, and rapid adaptation to emerging PhaaS capabilities. Organizations that ignore this trend risk losing control over their identities, their data, and their broader digital infrastructure.
