Device Code Phishing Fastest-Growing 2026 Threat

Device code phishing abuses OAuth 2.0 device authorization to steal access tokens, bypassing all MFA including passkeys. Microsoft reports 10 to 15 new campaigns daily, Barracuda counted 7 million attacks in four weeks, and Push tracks over 25 distinct kits.