Device Code Phishing Emerges as Fastest-Growing Threat, Bypassing All MFA
The OAuth 2.0 device authorization grant is being weaponized at an industrial scale, evolving into a sophisticated phishing technique that bypasses all forms of multi-factor authentication, including passkeys.
Device code phishing, a technique that abuses the OAuth 2.0 device authorization grant to steal access tokens, has rapidly transformed from a niche red-team tactic into an industrial-scale threat within the last six months. Originally designed for devices with limited input capabilities, such as smart TVs and printers, this authorization flow has been widely adopted for various applications, most notably for command-line interface (CLI) logins. While researchers first identified this attack vector in 2020, its widespread exploitation in the wild began around 2024 with nation-state actors, escalating significantly in 2025 and exploding in early 2026 with the release of the EvilTokens kit, which criminal adoption skyrocketed.
By April 2026, Microsoft was reporting 10 to 15 new campaigns daily, and Barracuda observed seven million attacks in just four weeks. The FBI issued a specific advisory for Kali365, a phishing-as-a-service (PhaaS) kit, marking the first time a US federal agency issued such a warning for a specific kit. Push Security, which has been tracking device code phishing since 2023, now identifies over 25 distinct phishing kits in circulation, with no signs of this trend slowing down.
A critical aspect of this threat is its ability to bypass all forms of multi-factor authentication (MFA), including passkeys and hardware security keys. This is because device code phishing targets the authorization layer, which occurs after the initial authentication. Victims, often already logged into their accounts, are tricked into copying a code, entering it on a legitimate device login page, selecting their account, and approving the access. This process circumvents traditional MFA, which primarily secures the authentication step, by exploiting the separation between proving identity and granting application access.
The phishing-as-a-service ecosystem has fully industrialized device code phishing, making it a standard offering. Kits like Tycoon2FA and Kali365 now include device code phishing capabilities alongside other advanced features. The rapid development and distribution of these kits are facilitated by AI, leading to structural similarities across different tools as they are generated from similar prompts. This mirrors the commercialization pattern seen with Adversary-in-the-Middle (AiTM) phishing, where a technique progresses from research curiosity to nation-state espionage to a widespread criminal commodity, but at an accelerated pace.
Attackers are developing new kits at an unprecedented rate, with over 25 distinct families emerging in 2026 alone. This surge is attributed to AI-assisted development, which has significantly lowered the barrier to entry. Many kits share common code architectures and layout patterns because they are generated by large language models responding to similar instructions. This rapid innovation cycle makes it challenging for defenders to keep pace with cataloging and mitigating new threats.
While Microsoft 365 is the primary target, accounting for approximately 99% of detected attacks, the threat is not limited to Microsoft. The OAuth 2.0 device authorization grant is a cross-platform standard, making any application implementing it a potential target. Nation-state actors have already used this technique against Salesforce, and platforms like GitHub, AWS, and others that support device code flows are vulnerable. GitHub, in particular, uses this flow for authenticating CLI tools and VS Code tunnels, presenting a significant attack surface for developers.
Device code phishing represents a broader shift in attacker strategies towards authorization attacks. As defenders have concentrated their controls on the authentication layer, attackers are increasingly targeting authorization mechanisms, which have received comparatively less attention. This trend, coupled with the rapid industrialization and AI-driven development of phishing kits, positions device code phishing as a paramount threat requiring immediate attention from security teams.