This page may contain stale information. Last updated: 2026-09-23
Definition
Device code phishing abuses the OAuth 2.0 device authorization grant — designed for input-constrained devices (TVs, IoT) — to trick users into approving attacker-controlled device enrollment against enterprise identity providers (e.g., Microsoft Entra).
Key Points
- 2026-09-22: eviltokens commoditized device code phishing at scale — first PhaaS platform to automate end-to-end device code + AI inbox analysis (2026-09-22-microsoft-eviltokens-ai-fraud-disrupted)
- Attackers generate device codes via hidden automation on phishing pages; victims enter codes believing they authenticate a legitimate device
- SpyCloud: 97.5% of EvilTokens victims were enterprise accounts
- Parallel techniques: Adversary-in-the-Middle (AiTM), Browser-in-the-Middle (BiTM)
Defensive Patterns
- Restrict or monitor device code flows via conditional access
- Independently verify payment-change requests via trusted second channel
- Assume compromised inbox contents analyzed in minutes, not days