6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026

Device code phishing abuses the OAuth 2.0 device authorization grant flow to steal access tokens. Originally designed for input-constrained devices (smart TVs, printers), the flow has been widely adopted for CLI logins and other use cases. In an attack, the victim is directed to a phishing page, given a short device code, and instructed to enter it on the legitimate provider's device login page (e.g., microsoft.com/devicelogin). The victim selects their account and clicks 'Allow', unknowingly granting the attacker an OAuth access token. Because the attack targets the authorization layer—not the authentication layer—it bypasses all forms of MFA including passkeys and hardware security keys. The attack was first described in 2020, adopted by nation-state actors (Storm-2372) in 2024, used by ShinyHunters against Salesforce at scale in 2025, and industrialized via the EvilTokens kit in February 2026. By April 2026, Microsoft reported 10–15 new campaigns every 24 hours, and Barracuda counted 7 million attacks in four weeks. The PhaaS ecosystem now includes kits like Kali365 (offering both AiTM and device code phishing), Tycoon2FA (added device code phishing in May 2026), and ARToken (ships with PRT persistence, mailbox access, BEC automation, and SharePoint exfiltration). AI-assisted development (LLM-generated code) has dramatically lowered the barrier to entry, resulting in 25+ distinct device code phishing kits in the wild. The attack is also part of a broader shift toward authorization-layer attacks, including ConsentFix (OAuth consent phishing discovered in late 2025). Stolen tokens can enable privilege escalation to full SSO-level access.