Device code phishing attacks surge 37x as new kits spread online

Summary

Device code phishing attacks exploiting OAuth 2.0 Device Authorization Grant flow have increased over 37-fold in 2024, with threat actors distributing new attack kits online. These attacks deceive users into approving device codes that grant attackers account access without requiring traditional credentials. The proliferation of easily accessible toolkits has dramatically lowered the barrier to entry for cybercriminals.

Indicators of Compromise

• malware — device code phishing kits

Entities