Device code phishing attack has targeted 340+ organizations

Cybersecurity researchers have identified an active device code phishing campaigntargeting Microsoft 365 identities at over 340 organizations in the U.S., Canada, Australia, New Zealand, and Germany.

The activity, reported by Huntress, was first detected on February 19, 2026, with incidents increasing rapidly. The campaign uses Cloudflare Workers redirects, with recorded sessions directed to a platform-as-a-service (PaaS)-hosted infrastructure called Railway, effectively turning it into a machine credential harvesting.

The sectors that have been targeted by attacks include construction, non‑profit organizations, real estate, industry, financial services, healthcare, the legal sector and government.

See also: GlassWorm malware hides RAT in Chrome extension

“What makes this campaign unusual is not just the device code phishing techniques, but also the variety of techniques observed,” the company said. “Offer construction baits, landing page code generation, DocuSign impersonation, voicemail notifications, and Microsoft Forms page abuse are all targeting the same group of victims via the same Railway.com IP infrastructure.”

Device code phishing: A relatively new attack tactic

Device code phishing exploits the OAuth device authorization flow to provide attackers with persistent access tokens , which can be used to take control of victims' accounts. Importantly, these tokens remain valid even after the account password is reset

The attack process involves the malicious actor requesting a device code from the identity provider (e.g., Microsoft Entra ID) via the legitimate device code API. The service responds with a device code. The malicious actor creates a convincing email that prompts the victim to visit a login page (“microsoft[.]com/devicelogin”) and enter the device code.

Once the victim enters the provided code, along with credentials and a two-factor authentication (2FA) password, the service generates an access token and a refresh token for the user.

“Once the victim is phished, their authentication generates a set of tokens that are displayed on the OAuth token API endpoint and can be retrieved by providing the correct device code,” Huntress explained. “The attacker knows the device code because it was generated from the initial cURL request to the device code login API.”

See also: Russian hacker jailed for running botnet

While the device code is useless on its own, once the victim is tricked and passes authentication, the resulting tokens belong to anyone who knows which device code was used in the original request.

The use of device code phishing was first observed by Microsoft and Volexity in February 2025, with subsequent waves recorded by Amazon Threat Intelligence and Proofpoint . Multiple Russian -linked groups , such as Storm-2372, APT29, UTA0304, UTA0307, ​​and UNK_AcademicFlare, have been linked to such attacks.

This technique is particularly insidious as it exploits Microsoft's legitimate infrastructure.

In the campaign detected by Huntress, the authentication abuse originates from a small cluster of Railway.com IP addresses. The attack begins with a phishing email that includes malicious URLs within legitimate redirect services from Cisco, Trend Micro, and Mimecast (to bypass spam filters).

This triggers a multi-step redirect chain that involves compromised sites, Cloudflare Workers, and Vercel as intermediaries before leading the victim to the final destination.

“The observed landing sites prompt the victim to proceed to the legitimate Microsoft device code authentication endpoint and enter a provided code to read some files,” Huntress noted. “The code is displayed directly on the page when the victim arrives.”

The landing page is also accompanied by a “Continue to Microsoft” message that, when clicked, displays a pop-up window that renders the legitimate Microsoft authentication endpoint (“microsoft[.]com/devicelogin”).

See also: Microsoft: IRS Phishing Attack Hit 29,000 Users with RMM Malware

Almost every device code phishing site is hosted on a Cloudflare workers[.]dev instance, which shows how threat actors are weaponizing the trust associated with the service in enterprise environments.

Protection

To combat the threat, users are urged to scan connection logs for Railway IP connections, revoke all refresh tokens for affected users, and block authentication attempts from the Railway infrastructure (if possible).

Huntress has linked the Railway attack to a new PhaaS platform known as EvilTokens, which debuted last month on Telegram. In addition to advertising tools for sending phishing emails and bypassing spam filters, the EvilTokens dashboard provides customers with open redirect links to vulnerable domains to hide phishing links.

Source: thehackernews.com