MalwarePublished 6 Apr 2026

Inside an AIenabled device code phishing campaign

Source AlienVault OTX General

Description

Microsoft Defender Security Research has observed a widespread phishing campaign leveraging the Device Code Authentication flow to compromise organizational accounts at scale. While traditional device code attacks are typically narrow in scope, this campaign demonstrated a higher success rate, driven by automation and dynamic code generation that circumvented the standard 15-minute expiration window for device codes. This activity aligns with the emergence of EvilToken, a Phishing-as-a-Service (PhaaS) toolkit identified as a key driver of large-scale device code abuse.

Impact

The campaign can lead to compromise of organizational accounts by tricking users into providing device codes through phishing sites. This abuse of the Device Code Authentication flow enables attackers to bypass standard expiration constraints, potentially allowing unauthorized access to sensitive resources. The impact is primarily account compromise and potential data exposure or misuse within affected organizations. There is no indication of exploitation of a software vulnerability or direct system compromise beyond credential theft.

Defensive guidance

Organizations should educate users about phishing risks related to device code authentication and monitor for suspicious authentication activity. Blocking or monitoring access to known phishing domains such as office365-login.com and portal-azure.com can help reduce risk. Review and enforce multi-factor authentication policies and consider conditional access controls to limit the impact of compromised credentials.

Summary

This threat involves a phishing campaign leveraging the Device Code Authentication flow to gain unauthorized access to organizational accounts. Unlike traditional device code attacks that are limited in scope and constrained by a 15-minute code expiration, this campaign uses AI-enabled automation and dynamic code generation to circumvent these limitations. The campaign is associated with EvilToken, a Phishing-as-a-Service toolkit that enables large-scale abuse of device code authentication. Indicators include several phishing domains mimicking legitimate Microsoft services. The campaign's medium severity reflects its potential impact on organizational account security, though no direct exploit or vulnerability in software is reported.

Inside an AIenabled device code phishing campaign

Description

Impact

Defensive guidance

Summary

Indicators of compromise

Domains 3

Community reviews

Description

AI analysisMachine-generated, updated 6 Apr 2026, 21:45 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

Indicators of compromise

Domains 3

Community reviews

Related threats