Device Code Phishing Evasion Techniques

Fri, 24 Jul 2026 00:00:00 +0000

We observed device-code phishing campaigns using four complementary evasion techniques. CAPTCHA gates block basic URL scanners while mimicking legitimate Microsoft security checks, and multi-step flows route victims through trusted SaaS platforms before revealing the phishing page.

Other campaigns decrypt phishing HTML inside the browser and deliver it through a session-unique blob URL that blocklists cannot retrieve. The pages also disrupt content detection with Cyrillic lookalike characters, zero-width spaces and randomized strings embedded in <bdi> elements, while remaining visually convincing to victims.

Evasion | He (Shawn) Shuang's Personal Site

Device Code Phishing Evasion Techniques