Full Report
Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved from a niche red-team technique to an industrial-scale threat in under six months. Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization login flow has been adopted by a wide range of apps and use-cases that it wasn't originally
Analysis Summary
# Tool/Technique: Device Code Phishing
## Overview
Device code phishing is a sophisticated attack vector that abuses the **OAuth 2.0 device authorization grant** flow. Originally designed for input-constrained devices (like Smart TVs) to authenticate via a secondary device, attackers now use it to bypass modern security controls. The victim is prompted to enter a user-provided code into a legitimate service provider’s login page (e.g., Microsoft), which subsequently grants the attacker an access token, bypassing Multi-Factor Authentication (MFA) and conditional access policies.
## Technical Details
- **Type:** Technique / Phishing-as-a-Service (PhaaS)
- **Platform:** Cloud Services (primarily Microsoft 365, Salesforce, and CLI-based integrations)
- **Capabilities:** MFA bypass (including Passkeys/FIDO2), token theft, automated post-compromise actions.
- **First Seen:** Conceptually in 2020; nation-state adoption in 2024; industrial-scale criminal use in early 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1528 - Steal Application Access Token]
- **[TA0005 - Defense Evasion]**
- [T1550.001 - Use Alternate Authentication Material: Application Access Token]
- [T1621 - Multi-Factor Authentication Request Generation]
## Functionality
### Core Capabilities
- **Authorization Hijacking:** Unlike traditional phishing, it does not steal credentials but hijacks the authorization layer.
- **MFA/Passkey Bypass:** Since the victim authenticates on a legitimate domain using their own trusted device, hardware keys and biometric protections are rendered ineffective.
- **Token Extraction:** Once the victim enters the code and clicks "Allow," the attacker's script automatically receives the access and refresh tokens.
### Advanced Features
- **PhaaS Integration:** Integrated into "industrial-scale" kits like **EvilTokens**, **Tycoon2FA**, and **Kali365**.
- **Post-Compromise Automation:** Modern kits like **ARToken** include automated SharePoint exfiltration, Primary Refresh Token (PRT) persistence, and Business Email Compromise (BEC) modules.
- **AI-Assisted Development:** Attackers are using LLMs ("vibe-coding") to rapidly generate and iterate on new phishing kit variants.
## Indicators of Compromise
- **File Names:** N/A (Web-based/PhaaS)
- **Network Indicators:**
- `microsoft[.]com/devicelogin` (Legitimate site used in the flow)
- `eviltokens[.]io` (Defanged)
- `kali365[.]online` (Defanged)
- `artoken-panel[.]net` (Defanged)
- **Behavioral Indicators:**
- Unusual OAuth 2.0 `device_code` grant requests in environment logs.
- Logins originating from "Cross-Platform Command Line Interface" or "Command Line Interface" applications for users who do not typically use CLI tools.
- Sign-in logs showing a successful login from one IP followed by an immediate resource access from a different, unrelated IP (Token theft).
## Associated Threat Actors
- **Storm-2372** (Early adopter, nation-state)
- **ShinyHunters** (Targeting Salesforce tenants)
- **EvilTokens Affiliates** (Financial crime)
- **Kali365 Operators**
## Detection Methods
- **Behavioral Detection:** Monitor Identity Provider (IdP) logs for the `urn:ietf:params:oauth:grant-type:device_code` grant type.
- **Application Monitoring:** Alert on the use of "Microsoft Command Line Interface" or other uncommon OAuth client IDs in environments where they are not standard.
- **Anomaly Detection:** Identify sessions where the IP address used for the device authorization differs significantly (geo-velocity) from the IP address that requested the code.
## Mitigation Strategies
- **Disable Device Code Flow:** Disable the device code flow globally if not required, or restrict it to specific, managed devices.
- **Conditional Access:** Implement strict Conditional Access policies that require "Compliant" or "Microsoft Entra joined" devices, which can block tokens generated via this flow on unmanaged attacker infrastructure.
- **User Education:** Train users to never enter codes into a website unless they personally initiated a login on an input-constrained device (like a TV or CLI).
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM):** Similar outcome but uses a proxy to steal session cookies rather than abusing OAuth flows.
- **EvilTokens:** The primary kit responsible for the 2026 surge in this technique.
- **Tycoon2FA:** A popular AiTM kit that recently added device code phishing capabilities.