Skip to content
Threat Feed

Tag

Device-Code

1 brief RSS
high advisory

Large-Scale OAuth Device Code Phishing Campaign Observed in April 2026

In early April 2026, Arctic Wolf tracked a large-scale device code phishing campaign across multiple regions and sectors where threat actors abused OAuth device code flow to trick victims into providing authentication codes.

Azure Active Directory oauth device-code phishing initial-access
2r 1t