Device code phishing industrialises: 25 kits, and Microsoft counts new campaigns daily

Device code phishing has gone from research curiosity to commodity in roughly two years, according to research published by Push Security. The attack abuses the OAuth 2.0 device authorization grant, designed for input-constrained devices such as smart TVs: the attacker initiates the flow, the victim types the code into a genuine provider login page, and the attacker receives real tokens without ever touching the authentication step. Microsoft reported 10 to 15 entirely new campaigns every 24 hours by April 2026, Barracuda counted 7 million attacks in four weeks, and Push tracks more than 25 distinct kits including EvilTokens, Kali365, Tycoon2FA, and ConsentFix. Microsoft accounts are 99 percent of observed targets, with Salesforce, GitHub, and AWS also hit.

Why it matters

This defeats phishing-resistant MFA without breaking it. The victim authenticates correctly, on the real domain, with a passkey if they have one. There is no credential to steal and no lookalike domain to block, because the fraud is in the device code flow itself: consent given for a session the user did not start.

That is why domain-blocking and awareness training both underperform here, and why the detection signal has to be behavioural rather than reputational.

The single highest-value control is boring: disable the device code grant in conditional access except for the handful of device classes that genuinely need it, then alert on device code authentications from unexpected clients or geographies. Our conditional access policies guide covers the rollout, and the ConsentFix campaign shows the same consent abuse in the wild.

Source: The Hacker News (contributed research from Push Security)