Device Code Phishing is an Evolution in Identity Takeover

Reported 14 May 2026 by otx · Severity: medium

Device code phishing attacks have exploded across the threat landscape, with new toolkits emerging weekly. This surge coincides with publicly released criminal toolkits and multiple phishing-as-a-service offerings like EvilTokens and Tycoon. Threat actors abuse the OAuth 2.0 devi