Device code phishing and voice phishing are becoming two of the fastest-moving identity attack trends of 2026.
The shift is important because both techniques bypass the place where many organizations still focus most of their defenses: the inbox. Device code phishing abuses a legitimate Microsoft authentication flow, while vishing uses real-time social engineering over phone calls or collaboration platforms to walk victims through account compromise.
Attackers are no longer only sending fake login pages. They are guiding users through real authentication flows, real MFA prompts, and real enterprise tools.
Device Code Phishing Becomes Industrialized
Device code phishing abuses the OAuth 2.0 Device Authorization Grant flow, which was designed for devices that are difficult to type on, such as smart TVs, printers, CLI tools, and other input-limited systems.
In a normal flow, a user visits a legitimate Microsoft page, enters a short device code, and completes authentication.
In the malicious version, the attacker generates the code and tricks the victim into entering it on Microsoft’s real login page. The victim completes normal authentication and MFA, but the resulting session tokens are issued to the attacker’s device or application instead of the user’s intended session.
This makes the attack extremely effective because there is no fake Microsoft login page to detect. The user is authenticating with real Microsoft infrastructure.
Why MFA Does Not Stop It
Device code phishing does not “break” MFA in the traditional sense.
MFA works exactly as designed. The user enters credentials, approves the MFA prompt, and Microsoft issues tokens.
The problem is that the attacker controls the device authorization flow. Once the victim completes authentication, the attacker receives valid access and refresh tokens.
That means a password reset alone may not be enough to remediate the compromise. Refresh tokens must also be revoked, and defenders need to investigate downstream activity such as mailbox access, SharePoint access, inbox rules, OAuth app activity, and new device registrations.
EvilTokens Helped Scale the Attack
One of the major drivers behind the rise is the emergence of phishing-as-a-service platforms such as EvilTokens.
EvilTokens packages device code phishing into a commercial service, making the technique easier for lower-skilled attackers to use. Reports describe pricing around $1,500 for an Office 365 capture kit, plus additional monthly or add-on costs for supporting infrastructure.
Huntress reported a 1,380% increase in device code phishing attacks between July–December 2025 and January–April 2026. That is why many reports describe the trend as roughly a 1,500% surge in 2026.
Push Security also reported a dramatic increase in detected device-code phishing pages in 2026, with Cloud Security Alliance noting a 37.5-fold rise in some observed telemetry.
AI Makes the Lures Better
Device code phishing has become more dangerous because modern kits are adding automation and AI-assisted workflows.
Attackers can generate more personalized lures, vary language and style, and automate parts of the post-compromise process. Some reporting describes AI being used to analyze stolen mailbox content and generate context-aware follow-on business email compromise messages.
This changes the economics of phishing.
What used to require manual targeting can now be packaged, sold, and scaled. Attackers can personalize messages without spending much time on each victim.
Vishing Is Also Rising
At the same time, vishing is making a major comeback.
Voice phishing uses phone calls, help-desk impersonation, fake IT support, or collaboration-platform calls to manipulate employees into approving access, resetting credentials, enrolling MFA devices, or entering device codes.
Mandiant’s M-Trends 2026 report found that highly interactive voice phishing rose to 11% of observed initial infection vectors, making it the second-most commonly observed vector globally.
Marsh’s 2026 UK cyber outlook also warned that vishing attacks doubled over the previous year as social engineering became more personalized, with AI expected to accelerate convincing phishing and deepfake impersonation.
Why Attackers Like the Phone
Vishing works because it creates urgency and trust.
A victim may ignore a suspicious email, but a phone call from someone claiming to be IT support, a manager, a help desk technician, or a security team member creates immediate pressure.
Attackers use that pressure to guide the victim through steps such as:
- entering a device code
- approving MFA
- enrolling a new authenticator app
- installing remote access software
- visiting a fake support page
- sharing one-time codes
- resetting passwords through attacker-controlled flows
This is especially effective against help desks and employees with access to SaaS platforms, cloud consoles, finance systems, or collaboration tools.
Device Code Phishing and Vishing Are Converging
The most dangerous campaigns combine both techniques.
Attackers call the victim first, build trust, and then direct them to a legitimate Microsoft page where they enter a device code. Because the victim is on a real Microsoft domain, the process feels safe.
The attacker does not need to steal the password directly.
They only need the victim to complete the flow.
Once the attacker has the tokens, they can access Microsoft 365 resources, read mailboxes, search SharePoint and OneDrive, create inbox rules, register devices, and move deeper into the SaaS environment.
Why Traditional Defenses Struggle
Traditional email security is not enough for this trend.
Device code phishing may use legitimate Microsoft authentication pages. Vishing may begin outside email entirely. MFA prompts may be valid. Conditional Access may see a successful authentication flow rather than a fake login page.
That means defenders need identity-level controls, not only message filtering.
The key signals are often found after the click or call:
- suspicious device code authentication
- unusual OAuth token activity
- logins from unfamiliar hosting providers
- new device registrations
- mailbox access from abnormal locations
- rapid SharePoint or OneDrive enumeration
- new inbox rules
- unexpected MFA method changes
- help-desk-driven password or factor resets
What Organizations Should Do
The most effective mitigation is to block device code flow where it is not needed.
Many organizations do not have legitimate business use for device code authentication across normal employee accounts. Microsoft now provides Conditional Access options to block or restrict device code flow, and security teams should review whether it is required in their tenant.
Organizations should also:
- revoke refresh tokens after suspected compromise
- monitor for device code authentication events
- alert on suspicious OAuth token use
- restrict MFA method registration
- harden help-desk identity verification
- train users on device code and vishing scenarios
- review Microsoft 365 mailbox and SharePoint activity
- use phishing-resistant MFA such as FIDO2 or passkeys where possible
- monitor collaboration platforms for social engineering attempts
- treat phone-based IT support requests as high-risk unless verified through known channels
Final Thoughts
The rise of device code phishing and vishing shows that attackers are adapting to stronger email filters and MFA adoption.
They are not always trying to steal passwords anymore. They are tricking users into authorizing the attacker’s session through legitimate workflows.
That is why this trend is so dangerous.
The login page is real.
The MFA prompt is real.
The phone call feels urgent.
The result is still compromise.
Identity security must move beyond passwords and inbox filtering. Organizations need tighter OAuth controls, stronger token monitoring, better help-desk verification, and phishing-resistant authentication before attackers turn legitimate login flows into their easiest way in.
