6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026

Device code phishing, which abuses the OAuth 2.0 device authorization grant to steal access tokens, has rapidly evolved from a niche red-team technique to an industrial-scale threat in under six months. Originally designed for input-constrained devices like smart TVs and printers, the device authorization login flow is now being exploited in a wide range of applications beyond its intended scope.