Device Code Phishing: The Login Trick That Blew Up in 2026

Key points

• Device code phishing, a scam that abuses a Microsoft and Google login flow built for TVs and printers, has grown from a rare trick to a mass-market attack in under six months.
• The technique lets criminals steal live access tokens without ever seeing the victim's password or one-time code.
• Nation-state groups tracked as Storm-2372 by Microsoft and overlapping clusters reported by Volexity have used it against government, defence and NGO targets through 2025.
• Traditional phishing filters often miss these lures because the login page the victim sees is the real Microsoft or Google one.
• Defenders can blunt the attack by turning off device code flow where it is not needed and by adding conditional access rules.

A login shortcut designed for smart TVs is quietly becoming one of the biggest identity threats of the year.

Six months ago it was a red team party trick. Now it's showing up in campaigns run by criminals and spies alike, according to reporting from The Hacker News and vendor telemetry from Microsoft and Volexity.

What is device code phishing, in plain English?

It's a scam that hijacks a real Microsoft or Google login screen. The victim types a short code into a genuine sign-in page, thinking they're helping IT or joining a meeting, and that code hands the attacker a live session on the victim's account.

The login flow itself is legitimate, built into the OAuth 2.0 standard, the shared rulebook that lets apps sign you in, for devices with no proper keyboard. Think of a smart TV asking you to visit a URL on your phone and type in an eight-character code to get signed in.

Criminals worked out they could play the part of the TV. They start a login on their own machine, get a code from Microsoft or Google, and send that code to a target with a plausible story. The target enters the code on the real login page, and the attacker's session is authenticated as the victim.

Why is this working so well?

Almost every defence people rely on sits in the wrong place. The victim visits a real Microsoft domain. Multi-factor authentication, the extra check that asks for a code from your phone, still runs, and the victim approves it on the attacker's behalf. Email filters see a short code, not a malicious link.

Our 13 July story on Forg365, a $400-a-month kit that automates exactly this flow, shows how quickly commodity tooling has lowered the barrier.

Who is actually using it?

Microsoft has publicly linked device code phishing to a cluster it tracks as Storm-2372, which it assesses with medium confidence as aligning with Russian state interests. The targeting, government, defence and NGO sectors across Europe and North America, overlaps with tradecraft reported by other vendors against separate clusters, so single-source attribution should be treated with care.

Criminal crews have piled in too. Initial access brokers, the people who break in and sell the keys, have been advertising device code phishing as a service on Russian-language forums since mid-2025.

Should you worry about stolen tokens after resetting your password?

Yes. As we reported on 28 July, changing your password no longer kicks hackers out. Refresh tokens stolen this way can survive a password reset, leaving an attacker sitting inside your account while you believe the threat is gone.

What should ordinary users watch for?

Be suspicious of any message, whether a Teams chat or an email, that asks you to open a Microsoft or Google login page and type in a code somebody else gave you. Real IT teams almost never work that way. Ring the person on a number you already have if something feels off.

Tell your employer's IT team fast if you entered a code you now regret. They can revoke the session before the attacker reads your mail or pivots deeper into the network.