Your MFA Won't Save You. Device Code Phishing Has Surged 37x This Year. Eleven Attack Kits Now Sell Microsoft 365 Account Takeover as a Service.

WHAT HAPPENED

Researchers at Push Security published findings on April 4 confirming that device code phishing attacks have surged 37.5 times since the start of 2026. The technique is not new. It was first documented in 2020 and saw limited use by state-sponsored groups in late 2025. What changed is that it became a product.

The inflection point was EvilTokens, a phishing-as-a-service platform that appeared in mid-February 2026 and began selling turnkey device code phishing infrastructure to anyone willing to pay. Within weeks, Huntress observed the kit hitting more than 340 Microsoft 365 organizations across the United States, Canada, Australia, New Zealand, and Germany. Sekoia published a detailed teardown of the EvilTokens operation on March 30, confirming its PhaaS business model and documenting its anti-analysis capabilities.

Push Security now tracks eleven distinct phishing kits offering this attack type. Names like VENOM, SHAREFILE, CLURE, LINKID, AUTHOV, DOCUPOLL, and FLOW_TOKEN represent a market that barely existed three months ago. Each kit uses realistic SaaS-themed lures, anti-bot protections, and cloud platforms for hosting. The barrier to entry has effectively been deleted.

WHY THIS ATTACK WORKS

The OAuth 2.0 Device Authorization Grant was designed for devices without full browsers. Think smart TVs, printers, conference room displays. The flow generates a short alphanumeric code that a user types into a legitimate Microsoft login page to authorize a device. Attackers have repurposed this legitimate mechanism into a credential theft pipeline that runs entirely through Microsoft's own infrastructure.

This is what makes device code phishing structurally different from traditional credential harvesting. The victim never visits a fake login page. They visit microsoft.com/devicelogin, a real Microsoft domain. They complete their real MFA challenge. They see no red flags because there are none to see. The entire compromise happens over legitimate Microsoft infrastructure, encrypted HTTPS channels, and authentic authentication pages. None of this triggers standard phishing filters or domain reputation alerts.

The result is a valid OAuth access token and refresh token delivered directly to the attacker. The refresh token persists even after a password reset, which means the standard incident response playbook of forcing a password change does not actually revoke the attacker's access. This is a structural gap in how most organizations think about identity compromise.

ATTACK CHAIN

THREAT ACTORS

This is not just a criminal tool. Proofpoint has tracked both financially motivated groups and state-aligned actors adopting device code phishing. TA2723, a high-volume credential phishing actor, began using the technique in October 2025 with salary and benefits themed lures. Russia-aligned group UNK_AcademicFlare has been running device code phishing campaigns since at least September 2025, targeting government, academic, and transportation sectors across the US and Europe using compromised .gov and .mil email accounts as launch points.

The pattern here mirrors what we have tracked across the broader supply chain threat landscape this year. A technique starts with sophisticated actors, gets documented by researchers, and then gets packaged into commodity tooling that anyone can buy. We covered this same dynamic with the TeamPCP supply chain cascade in March and the Axios npm compromise that Google attributed to North Korea's UNC1069 in early April. The velocity from state-sponsored innovation to mass market exploitation keeps compressing.

THE ELEVEN KITS

Push Security's research identifies eleven distinct phishing kits that now offer device code phishing capabilities. Each targets Microsoft 365 and uses realistic SaaS-themed lures with anti-bot protections and cloud hosting. Here is what the landscape looks like right now.

SECTORS UNDER FIRE

The targeting is broad and indiscriminate. Huntress confirmed compromises across construction, nonprofit organizations, real estate, manufacturing, financial services, healthcare, legal services, and local government. This is not precision targeting. It is volume-based opportunism, which is the natural result of any technique becoming available as a service. When the barrier to execution drops to zero, the attacker does not need to be selective.

For the sectors Atarus works most closely with, the implications are immediate. Local government IT teams, water district operations, healthcare providers, and mid-size financial firms are exactly the types of organizations that depend heavily on Microsoft 365 and treat MFA as the final word on account security. The assumption that MFA solves phishing is now provably false for any environment that has the device authorization grant flow enabled, which is most of them.

DEFENSE TAKEAWAYS