Device code phishing attacks surge 37x as new kits spread online

Device code phishing abuses the OAuth 2.0 Device Authorization Grant to trick victims into authorizing attacker-controlled devices; Push Security and Sekoia report a ~37.5x rise in these attacks in 2026 driven by phishing-as-a-service kits (notably EvilTokens) and numerous competing kits that use realistic SaaS lures, anti-bot measures, and cloud hosting. The write-up lists at least 11 kits and provides mitigation recommendations such as disabling the device-code flow when unnecessary, enforcing conditional access, and monitoring for anomalous device-code authentication events.