device code phishing

The Greatness phishing-as-a-service (PhaaS) toolkit now supports device code phishing, which exploits the OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication (MFA) and steal user tokens. This method allows attackers to seize control of accounts by leveraging a legitimate authentication protocol.

Device code phishing increased by 1,500% in 2026, while vishing attacks doubled. Attackers are using newer social engineering techniques to bypass existing security controls and reduce detectable evidence.

Device code phishing, which abuses the OAuth 2.0 device authorization grant to steal access tokens, has rapidly evolved from a niche red-team technique to an industrial-scale threat in under six months. Originally designed for input-constrained devices like smart TVs and printers, the device authorization login flow is now being exploited in a wide range of applications beyond its intended scope.

Modern phishing attacks, including Device Code phishing, can bypass MFA protections to access corporate accounts without stealing passwords. The webinar discusses how behavioral AI can help detect compromised accounts and automate response workflows.

The FBI-flagged phishing kit Kali365, previously targeting Microsoft 365, now expands to AWS, Okta, and Russian platforms using device code phishing. This marks an increase in the platform's scope and threat level.

Attackers are exploiting device code phishing by leveraging a service's legitimate new-device login flow to trick victims into granting account access. This method bypasses traditional two-factor authentication (2FA) by mimicking authorized login processes.