Report: Device Code Phishing is Surging

LevelBlue reports a rapid rise in device code flow phishing campaigns that exploit Microsoft’s authentication flow to harvest Microsoft 365 access and refresh tokens without capturing passwords, enabling account takeover and persistent access. Major commodity phishing kits and PhaaS platforms (Tycoon2FA, EvilTokens, Kali365, Ghost Hub, Cyb3r) have incorporated this capability—Tycoon2FA notably resumed operations after a takedown with device code features—making sophisticated token-harvesting attacks accessible to both skilled and low-skilled actors.