Multiple sophisticated phishing kits are now focusing on harvesting device codes to breach accounts without a password, according to researchers at LevelBlue.

“Device code phishing exploits a legitimate Microsoft authentication flow to harvest Microsoft 365 access and refresh tokens without ever capturing a password,” the researchers explain. “The core mechanic is straightforward: whoever initiates the authentication request receives the resulting tokens. Once obtained, the tokens allow attackers to access Microsoft 365 services, maintain persistent access through refresh tokens, and conduct follow-on activities such as further reconnaissance, phishing, and data extraction.”

Top commodity phishing platforms, including Tycoon2FA, EvilTokens, Kali365, Ghost Hub, and Cyb3r, have incorporated this ability, allowing unskilled threat actors to launch device code phishing attacks.

“Tycoon2FA provides the clearest example of how phishing kits mature over time,” the researchers write. “What began in 2023 as a straightforward AiTM credential harvester evolved into one of the most sophisticated PhaaS platforms documented. Despite a coordinated Europol and Microsoft takedown in March 2026, Tycoon2FA resumed operations within weeks, now with device code flow capability layered on top of its existing AiTM infrastructure. EvilTokens and Kali365 follow a similar trajectory, launching in early 2026 with AI-augmented capabilities already integrated and continuing to improve their functionality since launch. Kits that survive their first year tend to become significantly more dangerous in their second.”

The researchers expect commodity phishing kits to continue incorporating new techniques in order to overcome defenses.

“Device code flow phishing is accelerating rapidly and shows no signs of slowing,” LevelBlue concludes. “What began as a relatively simple lure has evolved into a sophisticated process that is now easily accessible to threat actors. The affiliate programs offered by PaaS platforms further lower the barrier, enabling both experienced operators and less-skilled actors to launch targeted and opportunistic campaigns against organizations.”

LevelBlue has the story: The Device Code Phishing Tsunami: What We’re Seeing in the Wild