Device code phishing — a technique that exploits OAuth 2.0 authorization to steal access tokens — has jumped from a specialized research method to an industrial-scale threat in less than six months, according to a new report from Push Security. The attack defeats every form of multifactor authentication, including passkeys and hardware security keys, because it targets the authorization layer that happens after login rather than the authentication process itself. Push Security now tracks more than 25 distinct phishing kits using this technique, a number that would have been unthinkable before 2026.
The report documents an explosive rise in device code phishing campaigns over the past year. Researchers first described the attack vector in 2020, but nation-state actors like Storm-2372 didn't start using it in the wild until 2024. By 2025, the hacking group ShinyHunters was deploying device code phishing against Salesforce tenants at scale, and in February 2026, the EvilTokens kit arrived and criminal adoption skyrocketed. By April, Microsoft was reporting 10 to 15 entirely new campaigns every 24 hours, while Barracuda counted 7 million attacks in four weeks. The FBI issued a standalone advisory on Kali365, marking the first US federal agency public service announcement about a specific phishing-as-a-service kit. Tycoon2FA, which Push previously tracked as the most common adversary-in-the-middle phishing kit in the wild, added device code phishing to its framework in May.
According to the report, the attack works by exploiting the gap between proving identity and granting application access — two separate steps that most security controls only protect at the first stage. In most cases, victims are already signed into their Microsoft account when they encounter the phishing page, the report notes. They copy a short code, enter it on the legitimate Microsoft device login page, pick their account from a dropdown, and click allow — that's the entire attack. The device code flow was originally designed for input-constrained devices like smart TVs and printers, but it has since been adopted by a wide range of apps and use cases it wasn't originally intended for, most commonly command-line interface logins. The ShinyHunters Salesforce campaign, which compromised over 1,000 organizations and produced 1.5 billion stolen records, used a malicious "DataLoader" application to abuse the device code flow at scale.
The report explains that AI-assisted development has collapsed the barrier to entry for building new phishing kits, allowing attackers to create tools faster than defenders can catalog them. Many of the kits Push tracks share structural similarities in layout patterns and code architecture because they were generated by large language models responding to similar prompts. Push VP R&D Luke Jennings built his own kit to demonstrate just how easy it is. The commercialization pattern mirrors what happened with adversary-in-the-middle phishing — a technique moves from research curiosity to nation-state espionage to criminal commodity, with each stage accelerating faster than the last — but device code phishing completed that entire journey in a matter of months rather than years. The attack isn't limited to Microsoft: 99% of the device code phishing Push detects today targets Microsoft, but the OAuth 2.0 device authorization grant is a cross-platform standard, and any application that implements it is a potential target, including GitHub and AWS.
The report recommends that organizations restrict device code authentication flows via conditional access policies where feasible, but notes this isn't always straightforward because device code flows exist for legitimate reasons and larger organizations often can't simply disable them without breaking developer tooling and command-line workflows. Detection has to happen where the attack happens, the report argues: the only vantage point that sees both the phishing lure and the device code approval across any provider is the browser, where Push operates. Device code phishing is part of a broader shift toward authorization attacks, as attackers move away from the authentication layer where defenders have concentrated their controls and toward authorization mechanisms that have received comparatively little attention.