6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026

Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved from a niche red-team technique to an industrial-scale threat in under six months. Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization login flow has been adopted by a wide range of apps and use-cases that it wasn't originally

The article describes a surge in device code phishing, where attackers abuse the OAuth 2.0 device authorization grant to steal access tokens, bypassing MFA and even passkeys, and turning what was a niche red‑team technique into an industrialized, phishing‑as‑a‑service powered threat.[1][6] Reports from Push Security, CSA, Huntress, and others document a 15x–37.5x increase in such attacks in early 2026, driven by commoditized kits like EvilTokens and AI‑generated, highly personalized phishing lures.[4][5][8][13] From a RealGround perspective, this represents high‑severity malicious AI use: generative AI and automation are lowering barriers to entry, increasing success rates, and enabling large‑scale account takeover via token theft rather than passwords or traditional credentials. Organizations should adopt Continuous AI Red Teaming to test identity and OAuth flows against these attack patterns and use AI CISO Advisory to update threat models, MFA strategies, and incident response plans around post‑authentication token abuse and AI‑enhanced phishing campaigns.