Device Code Phishing: An Evolving Technique Impacting SLTTs

By the CIS CTI team

The Center for Internet Security^® (CIS^®) Cyber Threat Intelligence (CTI) team assesses that device code phishing is a highly effective and versatile account compromise attack technique that is very likely to continue to evolve and impact U.S. State, Local, Tribal, and Territorial (SLTT) government organizations over the next year.

As a technique, device code phishing exploits user trust in legitimate authentication interfaces and unfamiliarity with device code authorization flows to silently take over accounts without harvesting passwords or intentionally triggering multi-factor authentication (MFA) prompts.

Open-source reporting from CrowdStrike indicates a rise in device code phishing industry-wide between January and November 2026, which aligns with a spike in U.S. SLTT activity between June and November 2026. This rise is largely due to the tactic’s integration into Phishing as a Service (PhaaS) kits, which according to Microsoft has enabled threat actors to further integrate and scale this technique across their attack chains for financial gain. Industry reporting from Push Security additionally indicates many organizations currently lack effective detection or prevention mechanisms as well as specific user training accounting for device code phishing.

Inside the Incidents Targeting U.S. SLTTs

The recent U.S. SLTT incidents exceeded the total reported volume CIS CTI received between January 2025 and May 2026. Across these incidents, threat actors leveraged two PhaaS kits: Kali365 and the recently disrupted EvilTokens, per another report from Microsoft. Device code phishing leverages social engineering and a legitimate OAuth 2.0 flow to authorize malicious devices which, when successful, silently grants threat actors access to victim accounts and associated enterprise cloud services, as noted by the Internet Engineering Task Force (IETF).

In many of these incidents, device code phishing emails feature subjects tailored to victims’ job responsibilities while claiming to include a “securely shared” document requiring “review.” These lures include hyperlinks embedded in the email body or in PDF attachments.

The links direct the user to a webpage that the threat actor controls. As soon as the intended victim reaches that page, the threat actor, posing as a device, requests a device code from a legitimate identity provider API endpoint, which starts the device code flow.

Once the threat actor receives the device code from the identity provider, they dynamically display it to the user via the webpage they control. Threat actors often mask the code as an "Access PIN" or "Verification Number" with a popup link to a genuine Single Sign On (SSO) provider page, and they provide instructions to paste the code into the popup to gain access to the document. (See Figure 1.)

^{Figure 1: EvilTokens Device Code Phishing SSO Page}

By submitting the device code in their authentic identity provider portal, the victim unknowingly approves the threat actor’s OAuth 2.0 device authorization request. Per 2025 reporting from Microsoft, the identity provider then generates an access token for the malicious device, which the threat actor retrieves to authenticate as the user via the API.

Threat actors can extend their access by obtaining refresh tokens, and they can establish additional authenticated sessions without further user interaction. The compromise can survive password resets, MFA modifications, and session logouts. As pointed out by AADInterals, administrators must also explicitly revoke tokens as well as identify and remove any rogue device registrations to eliminate a threat actor’s foothold.

Why Device Code Phishing Works

A key element of device code phishing’s efficacy is how its presentation deviates from users’ expectations of a phishing attack. It relies on legitimate authentication services that users implicitly trust while disguising an unfamiliar device code authorization process as a simple verification challenge. The only cases in which a user might typically receive a prompt for credentials, an MFA, or passkey prompt would be one in which they were not logged into a valid session already, and in those cases, the request would come from a familiar identity provider’s page and domain.

Though initial emails in a campaign can come from spoofed addresses on threat actor-controlled infrastructure, most email lures originate from compromised accounts on trusted domains that successfully pass SPF, DKIM, and DMARC[a] authentication checks and therefore would be unlikely to flag antispam filters. By leveraging the identity of these compromised accounts, threat actors exploit their targets’ trust in potentially familiar contacts and the legitimacy of their own or peer organizations.

Threat actors also often host page lure infrastructure on trusted domains (e.g., Cloudflare workers, etc.) or use such services to route users through redirection loops. As pointed out by LevelBlue, this lowers the likelihood that users would identify the site as malicious or that domain-based blocking tools would prevent the connection.

Post Compromise

Once threat actors gain account access, they typically aim to conduct financial attacks and propagate to further victims.

Open-source reporting provide examples of how threat actors have systematically executed post-compromise actions to achieve persistence, concealment, discovery, and exfiltration.

• Several of the examples have seen threat actors using API access to register additional malicious devices to the user’s account to strengthen their foothold and maintain real-time access to the user’s mailbox.
• Additionally, to hide their activity from users, threat actors alter email handling rules to automatically archive and “mark as read” incoming autoreplies, bounce-backs, and warnings before deleting them along with any sent lures from the user’s Sent Items folder.
• They also frequently access tenant directories and user address books to identify high-value targets for follow-on attacks, both within and outside the victim’s organization.
• Industry reporting from several outlets, including Microsoft Threat Intelligence, documents threat actors leveraging Graph API access on Microsoft tenants to exfiltrate sensitive information directly from shared drives and applications, such as documents from SharePoint and OneDrive, conversation history from Teams, and sensitive emails from Exchange Online. Threat actors leverage these resources to conduct account takeover (ATO) hopping, per Proofpoint, a technique which uses a compromised user account to deliver tailored device code phishing email lures to a volume of targets, and attempt to conduct business email compromise (BEC) attacks for financial fraud, as noted by Abnormal.
• In one U.S. SLTT incident, after threat actors successfully conducted an account takeover, they used the account to distribute further phishing emails to targeted personnel in nearly 400 external organizations in a single attack wave.

How Device Code Phishing Scales

Over the last several years, device code phishing has evolved from a hands-on, operationally demanding technique into a more accessible one that supports automated, tailored campaigns at scale due to its integration into PhaaS kits.

Initial versions of the technique seen by Microsoft in August 2024 required threat actors to manually initiate the device code flow and were constrained by short device code timeouts (15 minutes), brief access token lifespans (90 minutes), and token scopes limited to specific services.The success of these attacks often relied on other social engineering techniques, such as vishing (See Figure 2.) or smishing, and depended on real-time or near-real-time contact with the victim. As a result, device code attacks were largely limited to state-sponsored threats and highly resourced, specialized cybercriminal actors conducting targeted intrusions, according to Push Security.

By April 2025, however, security researchers had published proof-of-concept solutions to many of these obstacles, and by fall 2025, criminal groups began weaponizing this research to automate key stages of their attack chains and iterate on the technique to circumvent countermeasures, as noted by Dirk-jan Mollema, Dennis Kniep, and another report from Proofpoint.

^{Figure 2: Device code phishing evolution 2019-2026 (Push Security)}

In February 2026, Huntress and other open-source outlets reported on the release of EvilTokens, the first criminal PhaaS kit built specifically around device code phishing attacks. Over the following months, open-source reports highlighted the rise of similar kits and modules for existing Adversary in the Middle (AitM) offerings. These subscription kits incorporate additional features, such as dynamically generating device codes the moment a victim reaches a phishing page lure and automatically exchanging short-lived access tokens for continuously renewed Primary Refresh Tokens (PRTs) that expand authorization scope to cover an entire compromised account.

To better manage campaigns at scale, these products feature centralized dashboards with end-to-end artificial inteligence (AI) integration and enable the operator to manage and maintain active tokens and sessions, enumerate victim account permissions, profile potential follow-on targets, identify email threads for potential reply-chain hijacking, and integrate high value exfiltrated data into BEC attempts, according to additional reporting from Huntress and SpyCloud. Sekoia notes the tools now offer customized phishing templates and enable threat actors to generate volumes of custom lures using the platforms’ generative AI capabilities.

Additionally, the kits can assist threat actors with automatically deploying target-specific page lures and polymorphic redirect pages, standing up custom domains to send initial phishing lures, and enabling affiliates to optimize attack patterns by tracking real-time campaign success rates. By integrating these capabilities into managed attack platforms, large numbers of even low-skilled threat actors can conduct coordinated campaigns at scale.

PhaaS developers have continued to maintain and expand their kits with the assistance of AI. For example, threat actors used these kits to prompt users to download malicious remote endpoint management tools after completing the device code flow. Open-source reporting from Trend Micro has also highlighted recent variations in email lure behavior, in which threat actors engage targets in multi-turn conversations before introducing page lure links or fraudulent payment instructions. Proofpoint additionally reported that compromised OAuth permissions can enable lateral movement into cloud-managed endpoints, creating potential pathways for ransomware deployment.

Strengthen Your Defenses with the MS-ISAC

The CIS CTI team recommends U.S. SLTTs join the Multi-State Information Sharing and Analysis Center^® (MS-ISAC^®), a community dedicated to the Collective Cyber Defense of U.S. SLTTs. MS-ISAC members received early reporting on device code phishing threats targeting the U.S. SLTT community, including actionable recommendations, through the CIS CTI team's full analytic report on this campaign. Additionally, members can take advantage of proactive web security through the Malicious Domain Blocking and Reporting (MDBR) service and real-time threat indicator dissemination through our Indicator Sharing Program. This information is intended to provide actionable threat intelligence that directly supports proactive Collective Cyber Defense in the U.S. SLTT community along with informed decision-making.

Ready to harden your defenses against device code phishing attacks?

 

---

[a] Domain-based Message Authentication, Reporting, and Conformance (DMARC); DomainKeys Identified Mail (DKIM); and Sender Policy Framework (SPF) are email authentication methods that help prevent unauthorized parties from sending emails on behalf of a domain they do not own.