Device Code Phishing: The Login Trick That Blew Up in 2026
A login flow built for smart TVs is now one of the fastest-growing routes into corporate accounts, and identity teams are struggling to keep up.
Key points
- Device code phishing, a scam that abuses a Microsoft and Google login flow built for TVs and printers, has grown from a rare trick to a mass-market attack in under six months.
- The technique lets criminals steal live access tokens without ever seeing the victim's password or one-time code.
- Nation-state groups tracked as Storm-2372 by Microsoft and overlapping clusters reported by Volexity have used it against government, defence and NGO targets through 2025.
- Traditional phishing filters often miss these lures because the login page the victim sees is the real Microsoft or Google one.
- Defenders can blunt the attack by turning off device code flow where it is not needed and by adding conditional access rules.
A login shortcut designed for smart TVs is quietly becoming one of the biggest identity threats of the year.
It is called device code phishing. Six months ago it was a red team party trick. Now it is showing up in campaigns run by criminals and spies alike, according to reporting from The Hacker News and vendor telemetry from Microsoft and Volexity.
What is device code phishing, in plain English?
It is a scam that hijacks a real Microsoft or Google login screen. The victim types a short code into a genuine sign-in page, thinking they are helping IT or joining a meeting. That code hands the attacker a live session on the victim's account.
The login flow itself is legitimate. It was built into the OAuth 2.0 standard, the shared rulebook that lets apps sign you in, for devices with no proper keyboard. Think of a smart TV asking you to visit a URL on your phone and type in an eight-character code. The TV then gets signed in.
Criminals worked out they could play the part of the TV. They start a login on their own machine, get a code from Microsoft or Google, and send that code to a target with a plausible story. The target enters the code on the real login page. The attacker's session is now authenticated as the victim.
Why is this working so well?
Because almost every defence people rely on sits in the wrong place. The victim visits a real Microsoft domain. Multi-factor authentication, the extra check that asks for a code from your phone, still runs, and the victim approves it themselves. Email filters see a short code, not a malicious link to a fake page.
Six things have pushed the technique into the mainstream:
| Driver | What changed |
|---|---|
| Reach | Device code flow is enabled by default in many Microsoft 365 and Google Workspace tenants |
| Realism | The login page is genuine, so users and security tools trust it |
| MFA bypass | The victim performs MFA on the attacker's behalf |
| Token theft | Attackers walk away with refresh tokens that can last weeks |
| Tooling | Open-source kits automate the whole flow end to end |
| Attribution cover | Logins appear to come from normal cloud IP ranges |
Who is actually using it?
Microsoft has publicly linked device code phishing to a cluster it tracks as Storm-2372, which it assesses with medium confidence aligns with Russian state interests. The targeting, government, defence, NGOs and telecoms across Europe and North America, overlaps with tradecraft reported by other vendors against separate clusters, so single-source attribution should be treated with care.
Criminal crews have piled in too. Initial access brokers, the people who break in and then sell the keys, have been advertising device code phishing as a service on Russian-language forums since mid-2025.
What should ordinary users watch for?
Be suspicious of any message, Teams chat, WhatsApp or email, that asks you to open a Microsoft or Google login page and type in a code somebody else gave you. Real IT teams almost never work that way. If in doubt, ring the person on a number you already have.
If you entered a code you now regret, tell your employer's IT team fast. They can revoke the session before the attacker uses it to read your mail or pivot deeper into the network.
