Tradecraft Tuesday | We Need to Talk About Device Code Phishing

On Valentine’s Day 2025, a Russian threat actor, Storm-2372, used OAuth device code flow to hijack Microsoft Entra device registration to obtain the Primary Refresh Token (PRT) and persistence—and it hit nearly every Microsoft customer. Then, in March 2026, the EvilTokens campaign used device code phishing and Railway to automate large-scale attacks. OAuth device-code phishing has skyrocketed, and threat actors are only finding new ways to do it. Let’s find out what’s really going on. On this month’s Tradecraft Tuesday, we'll look at device-code phishing variations across different apps and stacks, how threat actors are bypassing code expiration times and delivery mechanisms, and where we see this threat evolving in the future.