Surprisingly Useful AI Article Enhancements
Cybersecurity firm Barracuda has detected more than 7 million device code phishing attacks over a four-week period, warning that the technique is being industrialised through phishing-as-a-service tools and poses a growing threat to Microsoft 365 and Entra ID environments.
The surge in attacks is being driven in part by the EvilTokens phishing kit, which tricks users into signing into Microsoft through the abuse of device codes. Barracuda’s research provides a step-by-step breakdown of how attackers exploit device code authentication to gain persistent, approved access to cloud services.
How device code phishing works
Device code authentication is a legitimate process that lets users sign in on one device by entering a short code on another trusted device. It is commonly used for devices with limited interfaces such as TVs, printers or command line interface tools.
In a device code phishing attack, the attacker first requests a real device code from Microsoft. They then send the victim a phishing lure that persuades them to enter the code into a legitimate login page such as microsoft.com/devicelogin. When the victim completes the authentication, Microsoft issues the OAuth access and refresh token, which passes directly to the attacker.
The victim believes they are authorising their own device, but they are in fact granting the attacker access to their account.
Why it is harder to detect
Device code phishing carries several advantages over traditional credential phishing that uses fake login pages, making it a particular concern for security teams.
The technique relies on legitimate authentication URLs rather than suspicious links. Traditional phishing requires a convincing fake website, which email filters can often identify. Device code phishing uses official Microsoft URLs, making malicious activity harder to spot.
It also bypasses multifactor authentication and conditional access policies. Because the victim authorises the new device themselves, the attacker receives a valid access token that passes these security checks.
Once the victim enters the code, the attacker receives a refresh token that allows them to maintain access to the user’s account for days or weeks, even if the user changes their password. This gives attackers persistent, long-term access without needing to steal passwords or trigger traditional security alerts.
The approach also exploits user familiarity. People are accustomed to entering six to eight character codes to link their devices, making them less likely to question the process.
Industrialised through phishing-as-a-service
Saravanan Mohankumar, Manager in the Threat Analysis Team at Barracuda, warned that the technique has moved beyond targeted campaigns into a scalable service model.
“Device code phishing has become industrialised as part of a PhaaS model, making it a dangerous and scalable threat,” Mohankumar noted.
“Security defences need to adapt quickly. Layered security controls, including advanced email filtering, identity protection mechanisms and continuous monitoring can significantly limit exposure,” he added.
Mohankumar also pointed to practical steps organisations can take to reduce their risk.
“Enforcing strict controls around device authorisation flows and raising awareness about entering verification codes only in trusted contexts can help prevent such attacks from succeeding,” he commented.
Related: Best Business Laptops for work & school
Related: Best Gaming Laptops
Related: Best Portable Laptop
Stealthy lateral movement
Beyond initial access, device code phishing enables attackers to move laterally within an organisation’s cloud environment without raising alarms. The attacker effectively hijacks a legitimate session, making their activity harder to distinguish from normal user behaviour.
Successful device code phishing gives attackers long-term access to cloud email and identity environments without stealing passwords or triggering the security alerts that conventional credential theft typically generates.
The 7 million attacks detected by Barracuda over four weeks underscore the speed at which the technique is scaling, driven by the availability of toolkits like EvilTokens that lower the barrier to entry for attackers.
Last Updated on April 24, 2026 by Nick Ross
