Device code phishing didn't need new code — it needed a legitimate Microsoft login flow- 238
May 11, 2026
A technique security researchers first observed in isolated red-team and espionage use back in 2020 has, within the space of a year, become a purchasable criminal service capable of bypassing MFA protections that organizations spent the better part of a decade building. Device code phishing doesn't exploit a software vulnerability at all — it abuses a legitimate Microsoft authentication flow exactly as designed, tricking a user into typing a code into Microsoft's own real login portal, and handing the attacker a valid authentication token in the process.
The mechanism is deceptively simple. A phishing email — delivered via a link, a QR code, or a PDF attachment — sends a target to a landing page mimicking Microsoft, DocuSign, or SharePoint, displaying a short device code and instructions to enter it at the genuine microsoft.com/device login address. If the target complies, they've unknowingly authorized the attacker's own application to access their Microsoft 365 account, no password or MFA code required beyond that single legitimate-looking prompt. What transformed this from a niche technique into a criminal growth industry was one small engineering shift: earlier versions generated the code in advance and raced a 15-minute expiration window, failing whenever a target didn't open the email in time. Current implementations generate the code on demand, the moment a victim clicks the initial link — removing the timing constraint that had limited the technique's success rate for years.
That refinement arrived alongside a fully commercialized phishing-as-a-service ecosystem. EvilTokens, first advertised on Telegram in February 2026 and reportedly built using AI code-generation tools, offers customizable landing pages impersonating Microsoft, Adobe, and DocuSign, plus a "Portal Browser" add-on that lets affiliates manage multiple compromised Microsoft 365 accounts at once to automate business email compromise at scale. Tycoon 2FA, an established adversary-in-the-middle phishing service, pivoted directly into device code offerings after a February 2026 law enforcement disruption degraded its existing infrastructure — a direct illustration of how disrupting one phishing modality simply pushes established criminal infrastructure toward an adjacent, less-defended technique rather than eliminating it. ODx, also tracked as Storm-1167 or FlowerStorm and among the most widely used adversary-in-the-middle kits currently active, has similarly added device code capability, built on a separate specialized kit called Kali365 — whether through theft, purchase, or partnership remains unclear. Proofpoint's researchers identified roughly seven near-identical device code phishing variants circulating within a single ten-day window in April 2026 alone, evidence of a technique now being copied, resold, and re-skinned faster than defenders can track individual kit lineages.
The cybercriminal actor TA4903 offers the clearest case study in how quickly this technique can displace an established playbook. Previously known for business email compromise operations impersonating small businesses and government entities, TA4903 pivoted to device code phishing almost exclusively starting in March 2026 — in one campaign, sending fake salary notification PDFs containing QR codes that routed victims through Cloudflare Workers infrastructure to convincing DocuSign and Microsoft impersonation pages. Notably, some TA4903 campaigns arrived with entirely blank email bodies, containing only a PDF attachment with no accompanying social-engineering text — a gap that suggests parts of the operation are automated to the point that the actor either didn't bother, or forgot, to complete the deception.
That combination of speed and carelessness runs through the entire trend. Proofpoint researchers draw a direct parallel to ClickFix, a separate social-engineering technique that went from obscure experimentation in 2024 to a staple across both cybercrime and espionage operations within roughly a year — both techniques rely on convincing a user to take one specific risky action inside a trusted-looking interface, and both scaled explosively once early adopters proved the model worked and PhaaS platforms turned it into a purchasable commodity. AI's role in that acceleration cuts in two directions simultaneously: "vibe coding" tools have measurably lowered the technical barrier to building and iterating on phishing kits, but the same speed has produced sloppy operational security — researchers have found exposed infrastructure, unsecured admin panels, and leftover artifacts from previous campaigns baked directly into new kits, the digital equivalent of criminals leaving fingerprints because the tools did the hard part for them and skipped the details that used to require expertise.
