Topic
A phishing technique abusing OAuth device-authorization flows, tricking victims into entering an attacker's code to steal valid login tokens.
Huntress found legitimate remote management software abused in 45% of the endpoint incidents it logged in the first quarter of 2026. A rogue copy can behave like IT's approved one, so defenders have to know which tools are sanctioned and how each install arrived.
Reality
ANY.RUN tied 351 sandbox analyses to CSuite, a phishing operation that steals Microsoft 365 sessions or installs ScreenConnect or Action1 for remote access. Resetting credentials leaves the remote-access half of an intrusion in place.
Reality
Google's threat intelligence team ties three suspected Russian clusters to abuse of Google OAuth, app passwords and device linking. MFA completes normally, so consent telemetry is the control.
Reality
Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
6 publishersReality
Microsoft's Digital Crimes Unit and its partners pulled down the EvilTokens phishing service about seven months after it launched, and British police arrested its two suspected operators. The authentication technique it sold survives on other platforms.
Perspective Coverage
8 publishersReality
The OAuth device authorization grant was built for smart TVs and printers. Kits such as EvilTokens use it to get victims to approve an attacker's sign-in on a page that really is Microsoft's, MFA included.
Reality
Microsoft says the phishing-as-a-service platform reached more than 12,000 inboxes at over 10,000 organizations in seven months by abusing a legitimate OAuth flow, and its Digital Crimes Unit has now disrupted the infrastructure behind the service.
Reality
eSentire's Threat Response Unit says the GhostCode kit abuses Microsoft's OAuth 2.0 device authorization grant, and the lure reached targets in late August 2026 as a procurement inquiry filed through a company's own web form.
Reality
The device code phishing cluster Microsoft disclosed in February 2025 is now assessed as an initial access arm of Midnight Blizzard. The sign-in flow the campaign abused works as designed, so the remedy is configuration.
Reality
eSentire says a phishing kit called GhostCode used Microsoft's device-code flow to register three devices within 77 seconds of a victim completing MFA, and one of them stayed enrolled in Intune until it was explicitly removed.
Reality
ANY.RUN says the kit lures staff with Teams, DocuSign and Dropbox pages, walks them through a genuine device code sign-in, and then takes the access and refresh tokens to register a device of its own.
Reality
Microsoft has tracked intrusions since May in which callers posing as IT told employees a passkey update was due, then steered them to a phishing page or a device-code prompt. The enrollment step is where the chain starts.
Reality
Microsoft's researchers describe a device code phishing campaign that minted fresh codes the moment a target clicked, defeating the expiry that used to hold these attacks down. The flow it abuses is only needed by hardware that cannot show a login page.
Reality
Microsoft Security Research describes callers posing as IT staff to get a Microsoft 365 session relayed or minted to their own client. The lasting damage comes from the MFA method they then register.
Reality
Wiz says rogue device registrations are drifting toward benign names, while nearly one in seven Entra tenants saw such an attack in 90 days. Naming strings were never the signal.
Reality