Cybersecurity threats continue to evolve, but recent findings from Barracuda Networks highlight a significant shift in how phishing attacks are carried out.
In April 2026, Barracuda reported detecting more than 7 million device code phishing attacks in just four weeks, linking the surge to a phishing‑as‑a‑service kit known as EvilTokens. These attacks specifically target Microsoft 365 and Entra ID environments by abusing a legitimate authentication process rather than stealing passwords or directing users to fake websites.
For businesses that rely on cloud email, document sharing and identity platforms—including legal practices, barristers, accountants, real estate agencies and professional services firms—this development is particularly relevant.
What Is Device Code Phishing?
Device code authentication is a legitimate Microsoft sign‑in method designed for devices with limited interfaces, such as printers, smart TVs and command‑line tools. Instead of entering credentials on the device itself, the user is given a short verification code and asked to enter it on another trusted device via an official Microsoft login page.
Attackers are now exploiting this familiarity.
In a device code phishing attack:
- The attacker requests a real device code from Microsoft
- The victim receives a phishing message urging them to enter the code
- The victim completes the process on a genuine Microsoft login page
- Microsoft issues OAuth access and refresh tokens, which are then passed to the attacker
No fake websites are involved, and no passwords are stolen.
Why This Method Is Harder to Detect
Unlike traditional phishing, device code phishing:
- Uses legitimate Microsoft URLs, not cloned sign‑in pages
- Can bypass multifactor authentication and conditional access, because the user authorises the session themselves
- Provides attackers with refresh tokens, allowing access to persist for days or weeks—even if the password is later changed
This makes the attack stealthier and less likely to trigger the alerts organisations associate with credential theft.
Why It Matters for Professional and Small Businesses
Barracuda’s findings point to a broader trend: phishing is moving away from stealing credentials and toward hijacking trusted authentication flows.
For businesses that handle confidential data, financial approvals or client communications, this can create a pathway to:
- Email account compromise
- Invoice and payment fraud
- Exposure of sensitive client information
The rise of phishing‑as‑a‑service tools like EvilTokens means these techniques are now widely accessible to cybercriminals, increasing their scale and frequency.
CSB’s Perspective
From CSB’s experience, this type of attack highlights an important truth: modern cyber incidents often look like normal activity.
Staff are not being asked to do something obviously dangerous. They are being asked to complete a task that feels familiar—entering a short code on a trusted Microsoft page.
This is why cybersecurity today is less about blaming users and more about:
- Designing safer identity and authorisation processes
- Adding visibility around unusual sign‑in behaviour
- Ensuring people understand when verification codes should—and should not—be entered
Awareness, not fear, is the most effective defence.
How Organisations Can Reduce Exposure
Barracuda recommends layered controls to limit the effectiveness of device code phishing, including:
- Advanced email filtering
- Identity protection and continuous monitoring
- Stricter controls around device authorisation flows
- Clear staff guidance on verification code use
Cybersecurity threats will continue to change, but the goal remains the same: protect access, protect trust, and protect clients.
Understanding new techniques like device code phishing helps businesses make informed decisions—without needing to become security experts themselves.
If you’d like to understand how identity‑focused security applies to your organisation, CSB is always happy to have a practical conversation.