Device code phishing is rising fast against government organisations in the United States, and the attacks now run largely on autopilot. The Center for Internet Security (CIS) Cyber Threat Intelligence team reported on 6 November 2026 that recent incidents against US state, local, tribal and territorial (SLTT) organisations exceeded the total volume it received between January 2025 and May 2026, and it expects the technique to keep evolving and hitting SLTT bodies over the next year.

The attack abuses a legitimate feature of the OAuth 2.0 standard. Normally, device code authorisation lets a device with no keyboard, such as a smart TV, display a code for the user to enter on a phone or computer. In the phishing version, the attacker starts that flow on a device they control, then tricks the victim into typing the code into a genuine sign-in page. The victim never hands over a password and never sees a multi-factor authentication prompt, yet the attacker’s device is authorised as if it belonged to them.

The lure usually arrives as an email tailored to the victim’s job, claiming a document has been securely shared and needs review, with a link in the message or in a PDF attachment. The link leads to a page the attacker controls, which displays the code disguised as an “Access PIN” or “Verification Number” alongside a pop-up link to the real single sign-on provider. The victim pastes the code into the authentic portal and unknowingly approves the attacker’s authorisation request. The identity provider then issues an access token to the malicious device, and the attacker can extend that access with refresh tokens and open further sessions without any more interaction from the victim.

What makes the technique hard to clean up is that the compromise can survive a password reset, a change of multi-factor authentication settings and a session logout. Administrators must explicitly revoke tokens and find and remove any rogue device registrations, or the attacker keeps their foothold. CIS notes that many organisations still lack detection or training aimed specifically at this technique.

Once inside an account, attackers typically move quickly to financial fraud and to spreading further. CIS describes cases where intruders registered additional malicious devices to keep real-time access to a mailbox, changed email rules to archive and mark as read any autoreplies, bounce-backs and warnings, then deleted their own sent lures from the Sent Items folder. They also mined tenant directories and address books for high-value targets, and used Graph API access on Microsoft tenants to take documents from SharePoint and OneDrive, conversation history from Teams and emails from Exchange Online. In one US SLTT incident, a compromised account was used to send phishing emails to staff at nearly 400 external organisations in a single wave.

The surge is driven by phishing-as-a-service kits. CIS names two kits behind the recent SLTT incidents: Kali365 and EvilTokens, the latter described as the first criminal kit built specifically around device code phishing when it appeared in February 2026, and since disrupted. The kits generate device codes the moment a victim reaches a lure page, automatically swap short-lived access tokens for continuously renewed primary refresh tokens, and offer dashboards, AI-generated lure templates and reply-chain hijacking. Open-source reporting from CrowdStrike cited by CIS shows device code phishing rising industry-wide between January and November 2026, matching a spike in SLTT activity between June and November.

The technique has come a long way in two years. Early versions seen by Microsoft in August 2024 required attackers to start the flow by hand and were limited by 15-minute codes and 90-minute tokens, so they were largely the preserve of state-sponsored and well-resourced groups. By autumn 2025, criminal groups were automating the steps, and the arrival of dedicated kits in 2026 put the method within reach of low-skilled actors. CIS recommends SLTT organisations join the Multi-State Information Sharing and Analysis Center, which shared early reporting and recommendations with members, and says staff should be trained to treat any unexpected request to enter a code on a sign-in page as suspicious, however legitimate the page itself looks.