Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse

This article covers an active device code phishing campaign abusing Microsoft 365's OAuth device authorization flow to compromise organizations across five countries.

• •Over 340 organizations in the U.S., Canada, Australia, New Zealand, and Germany have been targeted since February 19, 2026
• •Attackers exploit the OAuth device code flow to obtain access and refresh tokens that remain valid even after the victim's password is reset
• •The attack chain abuses legitimate redirect services from Cisco, Trend Micro, and Mimecast, then routes victims through Cloudflare Workers and Railway.com infrastructure to harvest credentials
• •A phishing-as-a-service platform called EvilTokens, debuted on Telegram, has been attributed as the orchestrator behind the Railway-hosted attacks
• •