Device Code Phishing Evasion Techniques

Fri, 24 Jul 2026 00:00:00 +0000

We observed device-code phishing campaigns using four complementary evasion techniques. CAPTCHA gates block basic URL scanners while mimicking legitimate Microsoft security checks, and multi-step flows route victims through trusted SaaS platforms before revealing the phishing page.

Other campaigns decrypt phishing HTML inside the browser and deliver it through a session-unique blob URL that blocklists cannot retrieve. The pages also disrupt content detection with Cyrillic lookalike characters, zero-width spaces and randomized strings embedded in <bdi> elements, while remaining visually convincing to victims.

Device Code-based OAuth Phishing

Mon, 23 Mar 2026 00:00:00 +0000

This active campaign abuses Microsoft’s legitimate device-code OAuth flow to capture application tokens instead of passwords. Victims interact with a real Microsoft sign-in page while the attacker’s infrastructure obtains the resulting token in the background.

The phishing pages combine trusted authentication flows with obfuscated payloads, developer-tool detection and debugger traps. A captured OAuth token can provide application-level access to email, files and identity data without exposing the victim’s password.

OAuth | He (Shawn) Shuang's Personal Site

Device Code Phishing Evasion Techniques

Device Code-based OAuth Phishing