Six Months of Device Code Phishing Kits: A Field Guide

This report describes how attackers abuse the OAuth device authorization flow—so-called device code phishing—to obtain valid session tokens even after MFA succeeds, and how the technique was commercialized by the EvilTokens phishing-as-a-service kit, which Microsoft linked to compromises of over 12,000 inboxes across more than 10,000 organizations; it outlines the attack sequence, operational changes (live code generation, redirectors), detection questions for SOCs, and mitigation steps such as blocking device code flow, tightening conditional access, preserving pre-auth evidence, and rehearsing employee responses.