A technique first published as security research in 2020 has moved from a single nation-state actor to widespread criminal use, with voice phishing doubling over the same period.

 

What happened

Researchers tracked fifteen times more device code phishing attacks through the first half of 2026 than during the second half of 2025, alongside a doubling of voice phishing over the same span, Dark Reading reported on August 4, 2026. Both techniques share a property that explains their appeal, since neither depends on getting a malicious message past an email gateway. Device code phishing tricks a target into entering an attacker-generated code on a genuine Microsoft sign-in page, which hands the attacker a valid token without any password changing hands. Voice phishing skips written communication altogether. Attackers using both are concentrating on cloud identities rather than endpoints.

 

Going deeper

The technique took nearly six years to travel from published research to common criminal use. A security researcher described the method publicly in October 2020, according to Dark Reading, and no one appears to have used it in a real campaign until August 2024, when an actor Microsoft tracks as Storm-2372 began running it against government bodies, defense organizations, telecommunications firms, higher education, and healthcare providers. Microsoft, which documented the campaign in February 2025, assesses with moderate confidence that the actor aligns with Russian interests. The lures posed as meeting invitations from WhatsApp, Signal, and Teams, and the actor typically opened by impersonating someone relevant to the target and building rapport before sending anything actionable. Criminal groups picked up the method through 2025, and by this year it had become standard equipment rather than a specialist capability.

 

What was said

"This technique could enable persistent access as long as the tokens remain valid," Microsoft Threat Intelligence wrote in its analysis published February 13, 2025. The company updated the post a day later after the actor shifted tactics, using a specific client identifier to obtain a refresh token, register an attacker-controlled device in the target's directory, and from there acquire a Primary Refresh Token granting access to organizational resources. Microsoft also noted the tokens involved are an industry standard rather than a flaw in its own code.

 

In the know

Speed is the operational problem with voice phishing, and one case shows both how fast it moves and where it breaks. Attackers called a victim, obtained credentials and a multifactor code, authenticated, and registered their own device for ongoing access inside four minutes, according to Dark Reading's account of an incident from February. The new device listing generated an alert, the victim noticed, and the attacker was removed twelve minutes later. Device registration is where these attacks become visible, since everything preceding it looks like an ordinary successful login from the identity provider's perspective. Attackers running these campaigns also direct targets to phishing pages on mobile devices, where the security software organizations install on laptops and desktops generally is not present.

 

The big picture

Healthcare appeared in the original target list, which puts this outside the category of threats a hospital security team can treat as somebody else's sector problem. The defensive answer is a configuration change rather than a detection improvement, since Microsoft recommends blocking device code flow wherever possible through Conditional Access policies and permitting it only where an input-constrained device genuinely requires it. Most healthcare environments have a small number of such devices, typically conference room displays and shared clinical terminals, which makes a scoped exception practical. Organizations should also restrict which users can enroll devices into the directory, alert on new device registrations, and know how to revoke refresh tokens rather than only resetting passwords. Social engineering delivered by phone or through a genuine login page leaves email filtering with nothing to inspect.

 

FAQs

Why does a legitimate authentication feature enable this attack?

Device code flow exists so that devices without a keyboard or browser, such as smart TVs and conference systems, can sign in using a code entered elsewhere. Nothing in the design distinguishes a code generated by the user's own device from one generated by an attacker, which is the gap the technique exploits.

 

What is a Primary Refresh Token and why does registering a device produce one?

It is a credential issued to a device registered in the directory, allowing single sign-on across connected applications without repeated authentication. An attacker who registers a device obtains one, which converts a temporary token theft into lasting access that survives password resets.

 

How do defenders spot device code phishing in logs?

Look for a user clicking a link to a device login endpoint followed within minutes by a successful sign-in, particularly one flagged with increased risk. A pause between an initial authentication error and a subsequent success can indicate the user stopping to copy a code from a message.

 

Does blocking device code flow break anything?

Rarely, and where it does the affected devices are identifiable in advance. Auditing which accounts currently use the flow before enforcing a block reveals the exceptions, which can then be scoped narrowly by user group or device rather than left open across the organization.

 

Why are mobile devices a preferred target for voice phishing?

Endpoint protection, browser isolation, and managed browser policies are usually deployed to laptops and workstations rather than to phones, so a phishing page opened on a handset faces fewer controls. Screen size also makes address bars and certificate details harder to check.