Central Intelligence
Central Intelligence®PERSPECTIVE IS EVERYTHING
Last Update: 10/27/2026 at 6:00 AM EST

Microsoft 365 Device-Code Phishing

Coverage from BleepingComputer, Security Affairs, and others

Microsoft 365 Device-Code Phishing topic image

Microsoft 365 device-code phishing exploits the OAuth device authorization flow to make victims approve an attacker-controlled device on a legitimate Microsoft sign-in page.

This can give attackers access and refresh tokens without collecting a password, enabling access to Outlook, Teams, OneDrive, SharePoint, and other connected services. Platforms such as Tycoon2FA, EvilTokens, Forg365, Kali365, Jalisco, and ARToken package these techniques into phishing-as-a-service offerings with lures, dashboards, token handling, and campaign infrastructure. The subject also includes related identity-phishing methods, such as rogue-device registration, mailbox-rule manipulation, and adversary-in-the-middle session theft.

Looking Back
146 Day Timeline
Feb 19Mar 19Apr 16May 14Jun 11Jul 9
All Articles11 articles
Important1 article · CI Score 60 and above
BleepingComputer / Bill Toulas
Tycoon2FA Uses Device-Code Phishing To Hijack Microsoft 365
eSentire reported Tycoon2FA device-code phishing campaigns using Trustifi tracking URLs to compromise Microsoft 365 accounts via OAuth device login.
5/17/2026 • Cybersecurity (Privacy-Relevant) • General
Interesting9 articles · CI Score 45–59
Security Affairs / Pierluigi Paganini
Microsoft Says Phishing Campaign Stole Auth Tokens From 35,000 Users
Microsoft disclosed mid-April 2026 code-of-conduct phishing that captured authentication tokens from over 35,000 users in 26 countries, with most victims in the United States.
5/5/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
Jalisco And OmegaLord Phishing Kits Bypass Microsoft 365 MFA
ReliaQuest reports phishing kits Jalisco and OmegaLord using OAuth device-code and phone-number harvesting to bypass MFA and exfiltrate Microsoft 365 data within minutes.
7/14/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
Helix Uses Vishing And MFA Abuse To Steal SharePoint Data
ReliaQuest identified Helix using vishing and device-code phishing to exfiltrate SharePoint data for extortion, with multiple organizations reporting related breaches.
7/9/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
Forg365 Uses AI To Target Microsoft 365 Accounts
ZeroBEC reports Forg365 and ForgCookie phishing techniques that steal OAuth tokens and refresh Microsoft SSO cookies to sustain Microsoft 365 account takeovers.
7/9/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Lawrence Abrams
Artoken PhaaS Adds Microsoft 365 Token Theft And BEC Tools
Cisco Talos reported ARToken, a device-code phishing service using Microsoft 365 token theft and Primary Refresh Tokens to sustain mailbox and cloud file access.
7/3/2026 • Cybersecurity Tech (Privacy-Relevant) • General
The Record / Jonathan Greig
FBI Warns Of Kali365 Microsoft 365 Token Theft Campaign
The FBI warned about Kali365, a Telegram-based phishing-as-a-service used to steal OAuth tokens and compromise Microsoft 365 accounts.
5/22/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
Fake Enterprise VPN Sites Steal Company Credentials
Storm-2561 distributes counterfeit vpn installers via spoofed vendor sites to steal credentials and vpn configurations, according to Microsoft.
3/13/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
EvilTokens Phishing Kit Steals Microsoft Tokens In Device Code Attacks
Sekoia reports EvilTokens device code phishing abuses OAuth 2.0 to steal Microsoft access and refresh tokens, enabling business email compromise across multiple countries.
3/31/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
Device Code Vishing Targets Microsoft Entra Accounts
Threat actors used device-code phishing and vishing in 2020s campaigns to abuse Microsoft OAuth device authorization and access Microsoft Entra accounts across corporate environments.
2/19/2026 • Cybersecurity (Privacy-Relevant) • General
Additional1 article · CI Score below 45
BleepingComputer / Bill Toulas
Device Code Phishing Attacks Surge 37x As Kits Spread Online
Push Security and Sekoia reported increased device code phishing in 2024, where OAuth 2.0 Device Authorization Grant abuse leads to account takeover via approved tokens.
4/3/2026 • Cybersecurity (Privacy-Relevant) • General