A phishing technique invented in a 2020 blog post sat dormant for four years. In 2026, it is a subscription service responsible for compromising 179,000 organizations in a single campaign.
In October 2020, a Microsoft security researcher named Nestori Syynimaa published a blog post describing a theoretical attack against the OAuth 2.0 device authorization flow, the protocol that allows devices like smart TVs and conference room displays to authenticate to cloud services by having the user enter a short code on a separate screen. The post outlined how an attacker could generate a device code, deliver it to a target, and capture the resulting authentication token when the target entered the code on Microsoft’s legitimate login portal. The technique required no fake login page, no credential interception, and no exploitation of a software vulnerability. It worked because the protocol was functioning exactly as designed.
For four years, the post circulated among security researchers as an interesting curiosity and nothing more. Then, in August 2024, a Russian state-sponsored group that Microsoft tracks as Storm-2372 began using the technique in a campaign targeting governments, NGOs, defense contractors, telecommunications providers, healthcare institutions, and energy companies across Europe, North America, Africa, and the Middle East. The lures were crafted to resemble meeting invitations on WhatsApp, Signal, and Microsoft Teams. The targets who entered the device codes authenticated on Microsoft’s real login page, completed real MFA, and handed over real session tokens to an adversary they never interacted with directly. Microsoft disclosed the campaign publicly in February 2025, and Volexity simultaneously documented at least two additional Russian intelligence clusters using the same technique independently, suggesting parallel development within the Russian state apparatus.
What happened next followed a pattern that security teams have watched repeat across phishing-as-a-service platforms, from Tycoon 2FA to Darcula: a state-sponsored technique proved its effectiveness, financially motivated operators noticed, and the commoditization cycle compressed years of sophistication into months of subscription pricing.
How device code phishing bypasses everything
The OAuth 2.0 device authorization grant, defined in RFC 8628, exists to solve a legitimate usability problem. A device without a full keyboard or browser, a streaming box, a printer, a conference phone, needs a way to authenticate to cloud services. The protocol’s solution is to separate the authentication into two channels: the device displays a code, the user enters that code on a trusted login portal using a separate device, and the identity provider issues a token to the original device once authentication succeeds.
In the attack variant, the adversary is the device. The attacker generates a device code through Microsoft’s authentication API and delivers it to the target through a phishing email, a WhatsApp message, a Teams invitation, or a vishing call. The email might impersonate a SharePoint document notification, a DocuSign signing request, or an Adobe Acrobat sharing alert. The target clicks the link, arrives at Microsoft’s genuine login page, enters the code, completes MFA, and authorizes what they believe is a legitimate application. The session token that Microsoft issues goes to the attacker.
The mechanics of what follows are immediate and automated. In incidents documented by Arctic Wolf, Huntress, and Microsoft, attackers register their own MFA devices against the compromised account within minutes, create inbox rules to suppress security notifications, and begin accessing email, OneDrive, SharePoint, and Teams data. Because the attacker holds a valid session token issued by the legitimate identity provider, their activity is indistinguishable from an authorized login in most security logs. The token persists even if the victim changes their password afterward.
The fundamental challenge for defenders is that every component of the attack chain touches only legitimate infrastructure. The login page is real. The MFA prompt is real. The token issuance is real. There is no fake website to take down, no lookalike domain to blocklist, and no credential harvesting page to detect. The impersonation operates at the campaign layer, in the lure that delivers the device code, while the authentication exploit operates entirely within the trust boundary of the identity provider.
From a state secret to a subscription service
The trajectory from state-sponsored innovation to criminal commodity took roughly eighteen months.
Storm-2372’s campaign ran from at least August 2024 through early 2025, targeting high-value organizations aligned with Russian intelligence priorities. By the time Microsoft and Volexity published their disclosures in February 2025, other Russian clusters had already adopted the technique. Proofpoint documented a sharp increase in device code phishing beginning in September 2025 as the technique spread from state actors to financially motivated groups. Operators associated with Tycoon 2FA, at the time the world’s largest phishing-as-a-service operation, began incorporating device code flows into their campaigns before the end of that year.
The inflection point arrived in mid-February 2026, when a platform called EvilTokens launched on Telegram. Sold in three subscription tiers at $600, $1,000, and $1,500, EvilTokens packaged device code phishing into a turnkey service: AI-generated lures personalized to each target, automated campaign templates, real-time dashboards tracking which targets had authenticated, and OAuth token capture that required no technical expertise from the operator. Within five weeks, Huntress tracked more than 340 compromised Microsoft 365 organizations across five countries. Microsoft’s VP of Security Research confirmed that the platform was generating hundreds of successful compromises per day. A single campaign on March 17, 2026, sent 1.5 million confirmed malicious messages to 179,000 organizations across 43 countries.
In April 2026, a second platform called Kali365 appeared on Telegram at $250 for a thirty-day subscription. The FBI issued a public service announcement on May 21, 2026, warning that Kali365 lowered the barrier to entry for less-technical attackers by providing the same capabilities EvilTokens offered at a fraction of the price. Arctic Wolf tracked a large-scale Kali365 campaign originating from a single IP address and impacting organizations across multiple sectors and regions. By mid-2026, BleepingComputer reported that device code phishing detections had surged 37.5 times in Q1 alone, with at least eleven competing PhaaS platforms now offering the capability.
The CrowdStrike 2026 Threat Hunting Report, published August 3, 2026, documented a fifteen-fold increase in monthly device code phishing attempts during the first half of the year. CrowdStrike noted that Cozy Bear, the Russian APT group also known as APT29, remained the most prominent operator, but “a diverse set” of financially motivated eCrime actors had adopted the technique at scale, deploying “dedicated device code and session management infrastructure” and “delivering device code phishing pages via Entra ID application OAuth redirection at scale.”
What the post-compromise activity reveals
The device code phishing campaigns documented across 2026 are not ending at token capture. The platforms are designed to facilitate business email compromise as the monetization layer.
After obtaining a session token, attackers consistently follow a pattern: register a new MFA device to maintain persistence, create inbox rules that delete or redirect security notifications to prevent the victim from discovering the compromise, and begin searching the mailbox and connected applications for data that enables further fraud. Huntress documented Kali365 operators searching compromised mailboxes for keywords related to invoices, wire transfers, and financial approvals. The NJCCIC advisory noted that post-compromise activity frequently escalated to BEC schemes in which the attacker, now operating from the victim’s legitimate email account, initiated fraudulent wire transfers or redirected payments.
This post-compromise pattern means that device code phishing creates brand impersonation in two directions simultaneously. The lures that deliver the device codes impersonate trusted platforms: DocuSign, SharePoint, Adobe Acrobat Sign, Microsoft Teams. The compromised accounts then become launching pads for impersonation of the breached organization’s brand to its own customers, partners, and vendors. A supplier who receives a fraudulent invoice from a compromised account has no way to distinguish it from a legitimate request, because it originates from the legitimate email address, carries the legitimate signature block, and references real transactions the attacker found in the mailbox.
Healthcare was identified by Microsoft as the most targeted sector for device code phishing in Q1 2026, a finding consistent with the broader pattern documented in healthcare impersonation campaigns where the sensitivity of the data and the trust patients place in institutional communications amplify both the yield and the downstream damage of each compromise.
What security teams should monitor
The challenge with device code phishing is that the attack operates in the gap between existing tools. Email security scans for malicious URLs, but the link points to login.microsoftonline.com. Endpoint detection watches for malicious processes, but the victim authenticates in a legitimate browser session. Identity platforms verify credentials and enforce MFA, but the authentication completes on its own terms. The compromise sits in the seam between these systems, which means the detection opportunities exist not at the authentication event itself but in the behavior that immediately follows it.
The most direct control is restricting the device code flow entirely. Microsoft recommends blocking it via Conditional Access policies in Entra ID and granting exceptions only for devices with a documented business need. For most organizations, the vast majority of users and endpoints will never require the device code flow, and blocking it eliminates the attack surface rather than attempting to detect abuse after the fact.
Where the flow cannot be fully blocked, the detection window is narrow but specific. New MFA device registrations within minutes of a login event are the most reliable early signal, and the one that CrowdStrike OverWatch used to detect a Cordial Spider intrusion within four minutes in February 2026. Inbox rules created immediately after authentication, particularly rules that delete or redirect security notifications, indicate an attacker suppressing alerts to maintain access. Authentication events originating from commercial residential proxies or VPN providers that do not match the user’s typical location pattern are another consistent indicator across the Cordial Spider and Snarky Spider campaigns documented in CrowdStrike’s 2026 Threat Hunting Report. And mass file access events from unusual user-agent strings, particularly Python-based agents, signal the automated data exfiltration tools that follow token capture.
The operational reality is that the window between token capture and data exfiltration has compressed to minutes. CrowdStrike documented one case in which Snarky Spider moved from account takeover to data theft in under five minutes. Detection that depends on daily log review or weekly access audits will not surface these intrusions in time. The monitoring has to be continuous, automated, and focused on the behavioral sequence rather than any single event.
The Bottom Line
Device code phishing represents the clearest example of what happens when a legitimate protocol feature becomes an attack surface and the commoditization cycle compresses faster than the defensive response. A technique that Russian intelligence operationalized in 2024 is now available to anyone with $250 and a Telegram account, and it bypasses the MFA, email scanning, and URL filtering that most organizations treat as their primary phishing defenses. The FBI, Microsoft, and CrowdStrike have all issued warnings in 2026. At least eleven competing platforms now offer the capability. For organizations that have not yet restricted the device code authentication flow in their identity environments, the exposure is not theoretical. It is priced, packaged, and operating at scale.
Key Takeaways
Device code phishing abuses the OAuth 2.0 device authorization flow by tricking victims into entering attacker-controlled codes on legitimate authentication portals like Microsoft’s login page. The victim completes real MFA on the real login page, and the resulting session token goes to the attacker. No fake login page or credential interception is involved.
CrowdStrike documented a 15-fold increase in monthly attempts in H1 2026. BleepingComputer reported a 37.5x surge in Q1 detections. A single EvilTokens campaign in March 2026 sent 1.5 million malicious messages to 179,000 organizations across 43 countries. At least eleven phishing-as-a-service platforms now offer the capability.
The technique was first described by Microsoft researcher Nestori Syynimaa in 2020 and operationalized by Russian state actor Storm-2372 in 2024. It spread to multiple Russian intelligence clusters in 2025, then to financially motivated eCrime groups, and was commoditized through PhaaS platforms EvilTokens and Kali365 in early 2026.
The victim authenticates legitimately on the real identity provider’s portal and completes real MFA. The attacker captures the resulting session token, not the credentials. MFA protects the authentication event, but the token that MFA produces is the asset the attacker steals. Changing the password afterward does not revoke the token.
The most effective control is blocking the device code authentication flow via Conditional Access policies in Microsoft Entra ID. Organizations should also monitor for anomalous device registrations, inbox rule creation following new logins, authentication from unusual locations, and atypical user-agent strings associated with token-based access.
