Device Code Phishing Surges 37.5x as New Kits Spread

Summary

Push Security reports a 37.5x increase in device code phishing this year, with at least 11 kits using SaaS-themed lures. It recommends disabling the flow when unnecessary and monitoring authentication logs.

Key points

• Attackers trick victims into entering an attacker-requested device code on a legitimate login page, authorizing the attacker’s device with access and refresh tokens.
• Push Security says detected device code phishing pages rose 37.5x this year, up from a 15x increase reported at the start of March 2026.
• EvilTokens is described as the most prominent kit; the article identifies at least 10 other kits offering the technique.
• The kits use realistic SaaS-themed lures, anti-bot protections, and cloud-hosted infrastructure to scale their campaigns.
• Push Security recommends disabling device authorization when it is not needed and monitoring for unexpected device-code authentication events, unusual IP addresses, and sessions.

MITRE ATT&CK

Products

Tools

Related Articles

• Huntress Ranks Tactics Putting Businesses at Riskbleepingcomputer.comEvilTokens · Microsoft 365 Apps for Enterprise
• Huntress Details Phishing Kits Targeting Microsoft 365 Tokens and Defender Responseshuntress.comEvilTokens · Microsoft 365 Apps for Enterprise
• CrowdStrike 2026 Threat Hunting Report Highlights Faster Exploitation and Rising Identity Attacksgithub.com/jacobdjwilsonEvilTokens · Microsoft 365 Apps for Enterprise
• Microsoft Says Outlook Zero-Day Was Exploited as It Patches 1,094 Flawssecurityweek.comMicrosoft 365 Apps for Enterprise
• Threat Actors Repurpose AI Pen-Testing Tool Artex for Automated Attacksdarkreading.comMicrosoft 365 Apps for Enterprise