TLDR Tech / InfoSec
Device code phishing attacks surge 37x as new kits spread online
Device code phishing, which abuses the OAuth 2.0 Device Authorization Grant flow to harvest valid access and refresh tokens without ever touching the victim's credentials, has grown 37.5x in 2026, largely driven by the EvilTokens PhaaS kit, which democratizes the technique for low-skilled actors. Push Security cataloged at least 11 competing kits, including VENOM, DOCUPOLL, and LINKID, all of which used SaaS-themed lures, anti-bot gates, and cloud-hosted infrastructure to evade detection. The proliferation signals a structural shift toward token-based account takeover that bypasses MFA entirely, placing identity detection controls and conditional access policy hardening at the center of the defensive response.
Read the full story