6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
Summary: Device code phishing, which abuses the OAuth 2.0 device authorization grant to steal access tokens, grew from a niche red-team technique into an industrial-scale threat in under six months, with Microsoft reporting 10 to 15 new campaigns every 24 hours by April 2026 and Barracuda counting 7 million attacks in four weeks. The attack works after login rather than against it: the victim copies a short code, enters it on the legitimate Microsoft device login page, and clicks allow, so passkeys, hardware keys, and phishing-resistant MFA make no difference.
Bottom line: Push Security now tracks more than 25 distinct device code phishing kits in the wild, and the ShinyHunters Salesforce campaign using a malicious DataLoader application compromised over 1,000 organizations and produced 1.5 billion stolen records. Restricting device code flows through conditional access only covers Microsoft, leaving GitHub, AWS, and other platforms that support the same grant exposed.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026