6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
- ID
- 9618
- Status
- summarized
- Published
- 31 Jul 2026, 7:24 PM
- Fetched
- 31 Jul 2026, 9:51 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/07/6-reasons-why-device-code-phishing-is.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 8.0
- Created
- 31 Jul 2026, 9:53 PM
- Tags
- Audience
- developerssaas_foundersai_agent_users
What happened
Device code phishing—abusing the OAuth 2.0 device authorization grant to steal access tokens—has gone from niche red-team technique to industrial-scale threat in under six months. By April 2026, Microsoft reported 10-15 new campaigns daily, Barracuda counted 7 million attacks in four weeks, and Push Security tracks 25+ phishing kits. The attack defeats all MFA including passkeys because it targets the authorization layer, not authentication: victims enter a code on the legitimate Microsoft device login page and click 'allow,' handing over a token.
Why it matters
If your app or CLI tool uses OAuth 2.0 device code flow, your users are now a high-value target. Review whether device code flow is necessary for your use case or can be replaced with a more constrained grant. For SaaS founders using Microsoft or Salesforce OAuth, educate users to never enter device codes from unsolicited prompts, and consider monitoring for anomalous token grants.
Discussion angle
Walk through the actual attack mechanics live: how a victim copies a code, enters it on the real Microsoft login page, and unknowingly authorizes an attacker's app—then discuss whether any of your own tools or agents use device code flow and what mitigations are realistic.