Five seconds after an employee finished MFA on Microsoft's real sign-in page, somebody else started using the account. Within 78 seconds that somebody had registered three devices and held a Primary Refresh Token. The employee never typed a password into a fake page. They copied a short code from a "document portal" and pasted it where Microsoft asked.
Device-code phishing steals Microsoft 365 tokens by getting an employee to approve a sign-in the attacker started. The attacker requests a device code from Microsoft, sends the employee to the legitimate device login page, and waits while the employee enters the code and completes MFA. Microsoft then issues access and refresh tokens to the attacker's client. EvilTokens, GhostCode, and GTG-20006 turned that one approval into confirmed mailbox access in 2026.
This page is the rolling "what happened" hub for device-code phishing. Individual cases are listed as one-sentence entries in the Updates section at the bottom of this page. Consent phishing, where a user grants a malicious app permissions, is a different problem and stays off this page. Fake login pages that relay codes live on the AiTM hub, and coached phone calls on the workforce vishing hub.
How a short code on a real Microsoft page hands over the account
According to eSentire's Threat Response Unit, GhostCode started with a polite sales inquiry. In late August 2026 the attackers posed as a procurement officer for BJ's Wholesale Club and used a Salesforce web contact form. When the sales team replied, they promised an NDA to sign. The follow-up email carried a WeTransfer link to a password-gated HTML file and the password to open it. BJ's was the impersonated brand.
The file hid its next stop behind junk padding, character-level comment noise, and an AES-256-GCM encrypted redirect that only the password unlocked. After a bot check and a Cloudflare Turnstile gate on what appeared to be a compromised chiropractic clinic site, the victim reached a polished document portal.
Behind it, the kit's server asked Microsoft for a device code using the Microsoft Authentication Broker app ID and dropped the user code into the page. The victim clicked "Authenticate", landed on Microsoft's legitimate device sign-in page, entered the code, and completed the normal sign-in, including MFA. Microsoft's page even said the request came from a device in the United Kingdom. The attackers had routed the request through a UK IP so that detail matched the victim's own country. A decoy NDA on BJ's letterhead closed the loop.
Then the clock started. First token use came five seconds after the approval. A Primary Refresh Token sign-in came at 32 seconds. Three devices were registered by 77 seconds, and an Intune enrollment succeeded at 78 seconds. eSentire revoked the grant, reset the credentials, and disabled all three devices, and it warns that Intune enrollment outlives token revocation.
What EvilTokens sold, and what GTG-20006 took
Microsoft Threat Intelligence describes EvilTokens as a phishing-as-a-service kit that emerged in February 2026 and compromised more than 12,000 inboxes in over 10,000 organizations. Microsoft tracks its developer as Storm-2992, which sold it on Telegram for $1,500 plus $500 a month. Subscribers got 44 lure themes and AI help writing role-specific emails.
A script generates a live device code, often copies it to the clipboard, and opens the official microsoft.com/devicelogin page. It then polls every three to five seconds across the 15-minute window. A user without an active session enters a password and MFA. A user who is already signed in only pastes the code and confirms. Some operators registered new devices within 10 minutes to generate a Primary Refresh Token. Others waited hours before creating inbox rules or pulling mail. Microsoft also tracked an April 2026 campaign aligned with EvilTokens that spun up thousands of short-lived polling nodes.
Anthropic's September 2026 threat report adds a state-linked case. GTG-20006, whose attribution Anthropic calls consistent with public reporting linking the actor to Midnight Blizzard, used a framework called Embassy Kit for device code phishing in a Microsoft 365 token theft campaign aimed at diplomatic and government personnel. Mail records were accessed and exfiltrated from at least eight organizations, including a national prosecutor office, a military education institute, and a regional intergovernmental organization. Public reporting does not establish which MFA methods those targets used.
| Case | What is confirmed | What it shows |
|---|---|---|
| EvilTokens (Microsoft) | 12,000+ inboxes, 10,000+ organizations | Device-code theft sold as a service |
| GTG-20006 (Anthropic) | Mail taken from at least eight organizations | State-linked use of the same flow |
| GhostCode (eSentire) | One account, three devices, mail harvested | Persistence inside 78 seconds |
| N0va (eSecurity Planet) | Kit capability and observed targeting | Same weakness, no named victim |
Why finishing MFA changed nothing for the victim
eSecurity Planet summed up the N0va kit in one line: "A genuine Microsoft sign-in page can still lead to an attacker-controlled session." ANY.RUN observed N0va targeting government, technology, consulting, and healthcare organizations across North America and Europe, with lures dressed as Microsoft Security, Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign. The kit also tried token exchange and device registration to reach Primary Refresh Token single sign-on. Microsoft documented the same weakness in a separate April 2026 campaign, where victims went through legitimate Microsoft authentication and attackers received valid tokens.
The push approval or six-digit code worked perfectly. It proved a real person signed in on the real page. eSentire put it flatly: "MFA does not protect against device code phishing. The token carries the MFA claim forward." Every one of the GhostCode operator's nine follow-on sign-ins passed MFA checks without asking the victim again.
A password reset does not end it either. Microsoft says standard session revocation often kills only refresh tokens and leaves access tokens working for up to an hour, which hands-on operators exploit. It recommends temporarily disabling the compromised account. Legacy MFA built on codes and push never had a moment to object, because the login it guarded was genuine.
FAQ
How does device-code phishing steal tokens if the user completes MFA?
Device-code phishing steals tokens by having the attacker start a Microsoft device code sign-in and getting the employee to finish it. In the GhostCode case eSentire documented, the victim entered an attacker-supplied code on Microsoft's legitimate sign-in page and completed MFA, and the tokens went to the attacker's polling server. Token use began five seconds later.
Which device-code phishing cases are confirmed compromises?
EvilTokens, GTG-20006, and GhostCode are confirmed compromises in public reporting. Microsoft counts more than 12,000 inboxes compromised through EvilTokens, Anthropic reports mail exfiltrated from at least eight organizations by GTG-20006, and eSentire responded to one GhostCode account takeover. eSecurity Planet's N0va coverage describes kit capability and observed targeting, not a named victim.
What did attackers do after the device-code approval?
Attackers used the tokens to register devices, obtain long-lived access, and read mail. eSentire saw GhostCode register three devices and obtain a Primary Refresh Token within 78 seconds. Microsoft saw EvilTokens operators create inbox rules that hide mail, map organizations through Microsoft Graph, and search finance and executive mailboxes for wire transfer details.
Is consent phishing the same thing as device-code phishing?
No. Consent phishing tricks a user into granting a malicious app standing permissions, while device-code phishing tricks a user into approving a sign-in the attacker started. Consent phishing is an authorization problem that no form of MFA addresses, and none of the cases on this hub describe it.
Updates
2026-09-22: Vendor disruption
Microsoft documented EvilTokens, a Storm-2992 phishing-as-a-service kit that turned device code sign-ins into more than 12,000 compromised inboxes in over 10,000 organizations before a Digital Crimes Unit disruption of its infrastructure.
Source: Microsoft Security Blog, Unmasking EvilTokens · Full analysis: legacymfa.sucks
2026-09-15: Incident response write-up
eSentire TRU traced a GhostCode attack from a fake BJ's Wholesale Club procurement inquiry to a real Microsoft sign-in with MFA, three attacker-registered devices, and harvested email.
Source: eSentire, GhostCode device code phishing kit · Full analysis: legacymfa.sucks
2026-09-11: Kit disclosure
eSecurity Planet reported ANY.RUN's disclosure of the N0va kit targeting North American and European organizations through Microsoft device-code sign-ins, and noted a separate Microsoft-documented April 2026 campaign with the same weakness.
Source: eSecurity Planet, N0va phishkit targets North America and Europe · Full analysis: legacymfa.sucks
2026-09-10: Threat intelligence report
Anthropic reported that GTG-20006, an actor it links to Midnight Blizzard consistent with public reporting, ran a Microsoft 365 device code phishing and token theft campaign that exfiltrated mail records from at least eight organizations.
Source: Anthropic, Countering misuse of AI: September 2026 · Full analysis: legacymfa.sucks
The prevention companion hub is on mfa2point0.com: stop device-code phishing by blocking the grant.
