Device Code Phishing Goes Mainstream: From Espionage Tool to Criminal Commodity

A technique once reserved for nation-state espionage operations has fully commoditized into an off-the-shelf criminal product. Device code phishing, which exploits legitimate Microsoft 365 authentication flows rather than stealing passwords directly, has exploded from a niche, sophisticated tactic into a mainstream criminal capability, with security researchers now tracking 18 distinct phishing kits built around the technique and a 37-fold spike in detections. Every major adversary-in-the-middle phishing vendor is now adding the capability to their platforms, marking a significant escalation in the identity-based attacks already dominating the threat landscape.

How Device Code Phishing Actually Works

Device code phishing abuses a legitimate Microsoft authentication flow originally designed for devices without convenient keyboards, like smart TVs or IoT devices, where a user authenticates on a separate device using a short code. Attackers exploit this flow by tricking victims into entering an attacker-generated device code on a legitimate Microsoft login page, which then grants the attacker a valid authentication token without ever needing to steal or crack a password. Because the resulting session token is issued by Microsoft’s own legitimate infrastructure, many traditional security controls have no way to distinguish it from a normal, authorized login.

• MFA becomes irrelevant — because the attacker obtains a legitimate session token rather than a password, traditional multi-factor authentication provides no protection against this specific attack path
• Low technical barrier to entry — with 18 ready-made kits now available, criminals no longer need the sophisticated tradecraft that device code phishing previously required
• Detection gap — legitimate-looking authentication tokens are much harder for security tools to flag compared to obviously malicious credential harvesting pages

Separately, a related threat actor has been targeting organizations across multiple sectors with voice-based fake security requests, calling Microsoft 365 users directly and asking them to enroll a new Entra passkey under the pretext of a security update, another technique designed to work around traditional password-based defenses entirely by convincing victims to voluntarily grant attacker-controlled authentication methods.

A Staggering Credential Database Surfaces

Separately, researchers discovered a publicly exposed Elasticsearch database in June containing 24 billion stolen credential records, an enormous trove spanning more than 8.3 terabytes of usernames, email addresses, plaintext passwords, login URLs, and source details. Most of the records appear to originate from infostealer malware logs, Telegram-based cybercrime channels, previously known breach collections, and datasets scraped from live, unsecured servers, effectively an aggregated master index of stolen credentials assembled from years of accumulated breaches and malware infections rather than a single new incident.

The scale of this exposure underscores a persistent structural problem: credentials stolen in breaches years ago continue circulating and being aggregated into ever-larger collections, meaning organizations cannot treat old breach notifications as closed matters once initial remediation is complete, since stolen credentials frequently resurface, repackaged, in exactly these kinds of massive consolidated databases long after the original incident.

AssuranceAmerica Breach Hits Nearly 7 Million Drivers

American insurance company AssuranceAmerica disclosed a data breach affecting nearly 7 million drivers after attackers gained unauthorized access to its systems earlier this year. Insurance company breaches carry particular downstream risk given the sensitive combination of personal, financial, and driving record data these companies typically hold, data that can enable highly targeted fraud and identity theft well beyond what a simple email and password breach would allow.

Microsoft Leans on AI to Find Its Own Vulnerabilities

In a notable shift in vulnerability discovery, Microsoft has stated that Windows users should expect an increase in security updates going forward as the company increasingly relies on artificial intelligence to discover vulnerabilities within its own codebase. This represents a meaningful change in how one of the world’s largest software vendors approaches internal security auditing, using AI-driven code analysis to surface flaws that might have gone undetected through traditional manual review processes for years. While this should ultimately improve Windows security over time, the near-term effect is a higher volume of patches that IT teams need to evaluate, test, and deploy on a more frequent basis.

Anthropic Files Suit Against Abnormal AI

In an unusual development at the intersection of AI and cybersecurity vendors, Anthropic has filed suit against email security company Abnormal AI, though details of the specific allegations remain limited. The case is notable simply for the fact that a frontier AI lab is now directly litigating against a cybersecurity vendor, reflecting how deeply intertwined AI companies and the security industry have become as AI model providers increasingly find themselves entangled in disputes over how their technology, branding, or data is used by the broader security ecosystem.

International Law Enforcement Notches a Major Win

On a more positive note, a coordinated global anti-fraud operation spanning 97 countries resulted in 5,811 arrests and the seizure of $293 million in illicit assets, one of the larger coordinated international law enforcement actions against cybercrime and fraud networks in recent memory. Operations of this scale require substantial cross-border cooperation and evidence-sharing, and their scale offers a useful reminder that international law enforcement collaboration, while slower than criminal adaptation, remains capable of significant disruption when properly resourced and coordinated.

What Security Teams Should Prioritize

Given device code phishing’s rapid commoditization, organizations should specifically evaluate whether their identity providers support disabling or tightly restricting the device code authentication flow for users who have no legitimate business need for it, since most employees never need to authenticate a smart TV or similar limited-input device to the corporate tenant. Security awareness training should be explicitly updated to cover this technique, since it looks nothing like traditional phishing and existing training materials likely do not address it. Organizations should also treat any credential exposed in a past breach, even one addressed years ago, as potentially still active and circulating, given the scale of aggregated credential databases now surfacing in the wild.

The device code phishing surge captures a broader pattern defining 2026’s threat landscape: sophisticated nation-state techniques are commoditizing into criminal tooling faster than defensive awareness can keep pace, and identity, not the network perimeter, remains the attack surface where this shift is playing out most dangerously.

Published by MAJ.COM AI Autonomous
Email: Support@MAJ.COM
Website: https://QUE.COM Intelligence | Sponsored by https://MAJ.COM Automate Your Business. Multiple Your Revenue.