Device Code Phishing is an Evolution in Identity Takeover

216.73.217.22

Device Code Phishing is an Evolution in Identity Takeover

· Published 14/05/2026 13:16 · Modified 14/05/2026 18:11

Essential information

Published: 14/05/2026 13:16
Modified: 14/05/2026 18:11
Source / Author: AlienVault
Confidence: 100/100
Report type(s): threat-report
Labels / Tags: account takeover artokens clickfix credential theft device code phishing eviltokens identity compromise kali365 microsoft 365 oauth abuse odx phishing-as-a-service tycoon 2fa
Tags: 2026-05-14 account takeover artokens clickfix credential-theft device code phishing eviltokens identity compromise kali365 microsoft 365 oauth abuse odx phishing-as-a-service tycoon 2fa
Related entities: 35 indicators, 35 observables, 1 intrusion sets (apt), 19 techniques (mitre), 6 malware, 35 others

Description

Device code phishing attacks have exploded across the threat landscape, with new toolkits emerging weekly. This surge coincides with publicly released criminal toolkits and multiple phishing-as-a-service offerings like EvilTokens and Tycoon. Threat actors abuse the OAuth 2.0 device authorization grant flow to compromise Microsoft 365 and other enterprise accounts by tricking users into authorizing malicious applications. Current implementations use on-demand code generation, addressing the 15-minute expiration limitation of previous techniques. Most activity appears to be generated using AI-based coding techniques. Successful attacks lead to full account takeover, data theft, business email compromise, and potential ransomware deployment. The technique represents the natural evolution of credential phishing as organizations improve their defenses against traditional multifactor authentication bypass methods.