[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKRNQAuY-wYLzy3nfhww1KtW4QvJVxcGTJPTPBgb48bI":3},{"article":4,"iocs":56},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":33,"category":34,"article_tags":38},"54ca1673-b2ab-4c56-8081-aac24e0cdeed","6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026","6-reasons-why-device-code-phishing-is-the-fastest-growing-threat-of-2026-5538f3","Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved from a niche red-team technique to an industrial-scale threat in under six months. Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization login flow has been adopted by a wide range of apps and use-cases that it wasn't originally","Device code phishing, which exploits the OAuth 2.0 device authorization grant to steal access tokens, has rapidly evolved into an industrial-scale threat. Initially a niche technique, it is now widely adopted by various applications and use-cases, including CLI logins. Nation-state actors and criminal groups have leveraged this method, leading to a significant increase in attacks, with new campaigns emerging daily.","Device code phishing, abusing OAuth 2.0, has rapidly become a major threat.","6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026 The Hacker NewsJul 31, 2026Phishing \u002F Browser Security Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved from a niche red-team technique to an industrial-scale threat in under six months. Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization login flow has been adopted by a wide range of apps and use-cases that it wasn't originally intended for - most commonly CLI logins. Researchers first described the attack vector in 2020, but it took until 2024 before nation-state actors like Storm-2372 started using it in the wild. By 2025, ShinyHunters was using device code phishing against Salesforce tenants at scale, then in February 2026, the EvilTokens kit arrived and criminal adoption skyrocketed. By April, Microsoft was reporting 10 to 15 entirely new campaigns every 24 hours. Barracuda counted 7 million attacks in four weeks. The FBI issued a standalone advisory on Kali365, the first US federal agency PSA about a specific phishing-as-a-service kit. Push Security added device code phishing to its Browser & Identity Attacks Matrix back in 2023 and now tracks more than 25 distinct device code phishing kits in the wild and counting. Entering the second half of 2026, there's no sign of the pace slowing. Push recently ran a deep-dive webinar on device code phishing covering the attack mechanics, a live demonstration of a custom-built phishing kit, and what comes next. Here are six takeaways that security teams should have on their radar. 1. It defeats every form of MFA, including passkeys Device code phishing doesn't attack the login flow. It attacks what happens after login - the authorization layer. In most cases, the victim is already signed into their Microsoft account when they encounter the phishing page. They copy a short code, enter it on the legitimate Microsoft device login page, pick their account from a dropdown, and click allow. That's the entire attack. Passkeys, hardware security keys, enforced phishing-resistant MFA - none of it makes a difference, because the device code flow is separate from the authentication mechanism. The attack exploits the fact that proving your identity and granting access to an application are two different things, and most security controls only protect the first. 2. The PhaaS ecosystem has fully industrialized it Device code phishing is no longer a specialist technique. It's a standard feature in the phishing-as-a-service catalog. Tycoon2FA, which Push previously tracked as the most common AiTM phishing kit in the wild, added device code phishing to its framework in May. Kali365 offers both AiTM and device code phishing in a single platform. Some security firms are reporting that the structural similarities between kits are evidence of the ecosystem forking and fragmenting. But based on what we've seen, kits built independently using similar LLM instructions can look just as alike (more on this below). Regardless, the capabilities these kits offer keep getting better: for example, ARToken ships with PRT persistence, mailbox access, BEC automation, and SharePoint exfiltration packaged as product features for paying operators. The commercialization pattern mirrors what happened with AiTM phishing: a technique moves from a research curiosity to nation-state espionage to a criminal commodity, each stage accelerating faster than the last. But device code phishing completed that entire journey in a matter of months - a compression that reflects both the maturity of the existing PhaaS market and the speed at which AI-assisted development lets new capabilities get built and distributed. 3. Attackers are vibe-coding new kits faster than defenders can catalog them Push now tracks more than 25 distinct device code phishing kits in the wild - a number that would have been inconceivable before this year. For context, a brand-new AiTM phishing kit appearing in the wild used to be a significant event that happened once every few months. Having 25+ kit families emerge this year alone reflects a fundamental change in how phishing tools get built. AI-assisted development has collapsed the barrier to entry. Many of the kits Push tracks share structural similarities like similar layout patterns and similar code architecture, because they were generated by LLMs responding to similar prompts. Push VP R&D Luke Jennings spun up his own kit to demonstrate just how easy it is. 4. It's not just a Microsoft problem 99% of the device code phishing Push detects today targets Microsoft, but the webinar demonstrates why that won't last. The OAuth 2.0 device authorization grant is a cross-platform standard, and any application that implements it is a potential target. Nation-state actors have already used device code phishing against Salesforce in targeted campaigns. The ShinyHunters Salesforce campaign, which compromised over 1,000 organizations and produced 1.5 billion stolen records, used a malicious \"DataLoader\" application to abuse the device code flow at scale. Device code phishing is less universally applicable than AiTM - not every app implements the device authorization grant - but it has the advantages we've already described: it bypasses all MFA including passkeys, it doesn't require cloning a login page, and the user interacts with legitimate provider URLs. Apps like GitHub, AWS, and others all support device code flows, and for GitHub it's a core part of how developers authenticate CLI tools and VS Code tunnels. As kit developers look beyond Microsoft, these are the targets that open up. 5. It's part of a broader shift toward authorization attacks Device code phishing isn't an isolated technique. Attackers are moving away from the authentication layer because that's where defenders have concentrated their controls, and authorization mechanisms have received comparatively little attention. Push uncovered ConsentFix in late 2025, a browser-native OAuth consent phishing technique initially attributed to Russian actors that has since appeared in criminal toolkits. Like device code phishing, ConsentFix targets the authorization layer and defeats passkeys for the same structural reason: the attack occurs after authentication has already succeeded. As attackers continue to develop new ways to abuse consent flows, device registration, and token exchange mechanisms, this gap will widen unless defenders adapt. 6. Detection has to happen where the attack happens Device code phishing pages can be delivered through any channel: email, messaging apps, social media, search engine results, compromised websites, and more. The user enters the code on the provider's legitimate login URL, which means the attack transits through infrastructure that no network proxy, URL reputation service, or email gateway is going to block. The most common mitigation advice for Microsoft environments is to restrict device code authentication flows via conditional access policies, and that's a good step where it's feasible. But it's not always straightforward - device code flows exist for legitimate reasons, and larger organizations often find they can't simply disable them without breaking developer tooling, CLI workflows, or constrained-device scenarios. Even where organizations do lock it down for Microsoft, that does nothing to protect against device code phishing targeting GitHub, AWS, or other platforms where equivalent conditional access controls may not exist. The only vantage point that sees both the phishing lure and the device code approval - across any provider - is the browser, which is where Push operates. Push's agentic threat hunting pipeline writes and deploys detection rules continuously, targeting the technique class: i.e. the behavioral signatures of device code phishing kits and the device code approval flow itself rather than specific kit fingerprints or domains. That","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002F6-reasons-why-device-code-phishing-is.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiamJN4Z-p-XmpB_1nwgfCMj2JvWAmGP4avhjI3pBYb11kgANQy4wQf2DQ4VGJEXom4eZCFoqVozP4aJPPtpGufYrEe5E9xkebmctud6KO7NZEfNCiT14ln7CmZA1bB3m6HYNdiUnShVsIpr03SYa7jlZWnbml9R1HbqECSbnUH0DTqyETz1fpiNIqhExw\u002Fs1600\u002Fpush-main.jpg","2026-07-31T11:24:59+00:00","2026-07-31T12:00:25.625179+00:00",9,[18,21,24,26,29,31],{"name":19,"type":20},"OAuth 2.0","technology",{"name":22,"type":23},"Storm-2372","threat_actor",{"name":25,"type":23},"ShinyHunters",{"name":27,"type":28},"Microsoft","vendor",{"name":30,"type":28},"Barracuda",{"name":32,"type":28},"Push Security","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":55},{"id":33,"icon":35,"name":36,"slug":37},[57,60,63,66],{"type":53,"value":58,"context":59},"Kali365","A specific phishing-as-a-service kit used in device code phishing attacks.",{"type":53,"value":61,"context":62},"EvilTokens","A kit that contributed to the skyrocketing criminal adoption of device code phishing.",{"type":53,"value":64,"context":65},"Tycoon2FA","A phishing kit that added device code phishing capabilities.",{"type":53,"value":67,"context":68},"ARToken","A device code phishing kit offering features like PRT persistence and mailbox access."]