MFA Bypass

Device Code Phishing After EvilToken: The 15-Minute Window Is Gone

Apr 7, 2026 7 min read Secto Research

Device code phishing used to have a built-in weakness. The attacker had to get a victim to use a short-lived device code before it expired.

The newest campaigns changed that. In a public April 6, 2026 case study, researchers described lures and landing pages that generate a fresh code only after the victim arrives. That turns a narrow timing window into a scalable workflow.

That is why this matters. This is not just another fake login page story. It is a way to abuse a legitimate device-authorization path so the user does the dangerous part themselves.

How The April 2026 Campaign Works

Classic phishing usually asks the user to trust a fake destination. Device code phishing feels more convincing because the workflow can end on a real identity-provider page. The malicious step is the handoff that gets the victim there and the instructions wrapped around it.

  1. The victim receives a personalized business lure, often framed as a document, invoice, or approval workflow.
  2. The lure opens a polished landing page that imitates a familiar enterprise sign-in flow and pushes the user to continue.
  3. The attacker backend requests a fresh device code in real time instead of reusing an old one.
  4. The victim enters the code on a legitimate device login page and completes MFA.
  5. The attacker receives usable tokens and moves straight into post-compromise activity such as mailbox access, Graph reconnaissance, or inbox-rule abuse.
Slide showing the device code phishing flow from lure to live authorization and token theft

What Changed From Older Device Code Attacks

The old limitation was time. Pre-generated codes expired quickly, which made campaigns harder to run at scale. Real-time code generation removes that problem.

That is the practical shift defenders should remember. The technique is no longer fragile. Attackers can wait for a live victim, generate a valid code on demand, and keep the entire interaction inside a workflow that looks familiar.

Slide mapping defender controls to a modern device code phishing chain

What Security Teams Should Do Now

  • Restrict device code flow where possible. If the business does not need it, remove the path attackers are abusing.
  • Look for token-centric post-compromise behavior. Inbox rules, strange device registration, and unusual Graph access matter more than password reset alone.
  • Teach users that a real login page can still be part of a phish. The problem may be the handoff and the instructions, not the last domain they see.
  • Inspect the rendered page journey, not just the opening URL. The dangerous signal is often in the browser session itself.

Where Secto Fits

This attack does not depend on a single fake page. It depends on a deceptive browser handoff that convinces the user the next identity step is expected. That is where Secto is useful.

  • Secto adds a browser-side checkpoint before the user is pushed from a deceptive landing page into a trusted authorization flow.
  • It helps security teams judge the handoff pattern itself, including overlays and deceptive instructions that wrap a legitimate identity-provider step.
  • It gives defenders a practical way to interrupt OAuth-linked phishing chains before a fresh device code turns into a usable session.