Rise of the latest scam, device code phishing has spiked 1,500% in the first half of 2026 compared to the second half of 2025, with some tracking reports noting a 37-times surge over a brief tracking period. [dark reading] By April 2026, Microsoft reported observing 10 to 15 new device code phishing campaigns every 24 hours.
What is Device Code Phishing?
Device code phishing is a trick where an attacker sends you a short code (often in an email, Teams message, or chat) and asks you to enter it on a real Microsoft sign-in page, like microsoft.com/devicelogin. They might claim it’s needed to join a meeting, open a shared document, or verify your account.
The page and the MFA prompt are genuine, but when you enter the code and sign in, you are unknowingly authorizing the attacker’s session instead of your own. This can give them access to your email, files, and other Microsoft 365 data.
Device Code Phishing Example:
I am trying to log into my Netflix account on a hotel TV. It should not surprise me that the TV is giving me or asking me for a device code. I was not given a device code to input out of the blue and asked to start a new transaction. I started something that I wanted to do, which led to me being given a device code.
In the case of device code phishing, the user is not doing anything that should be expected to create a device code transaction. The request to use a login that generates the device code arrives unexpectedly and includes the device code they are expected to use. The fact that it is arriving before the user has done anything to start the process is the main tell that this is a device code scam. This is a subtle, but important difference.
What You Should Do
The best defense against device code phishing is education, specifically being aware of unexpected requests to input a provided device code that was not initiated. Never enter a device code you didn’t personally request from a device or app you are actively trying to sign in to. If you receive an unexpected request like this, ignore it and report it to IT.
