6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026

Device code phishing, a rapidly growing threat exploiting the OAuth 2.0 device authorization grant, has evolved from a niche technique to a widespread criminal and nation-state tactic in a matter of months. Attackers are leveraging AI-assisted development to create increasingly sophisticated phishing kits that bypass MFA, including passkeys, and target a wide range of platforms beyond Microsoft. Due to its ability to bypass traditional security controls and its increasing commercialization, device code phishing is becoming a significant concern for organizations across various sectors. Mitigation efforts are proving challenging due to the technique's cross-platform nature and the difficulty of blocking attacks that transit through legitimate provider URLs.