AI-driven phishing attacks exploiting device-code authentication surge worldwide

A quarterly bulletin from the Directoratul Național de Securitate Cibernetică highlighted a rapid increase in device-code phishing, a method that deceives users into granting account access without revealing passwords. Huntress reported that the number of such attacks has risen sharply in the first four months of 2026 compared with the previous six months. The scheme exploits the standard device authorization flow for smart TVs, printers and similar hardware, allowing hackers to sidestep multi-factor authentication.

Artificial intelligence enables attackers to generate unique, personalized phishing messages for each target, and a commercial toolkit called EvilTokens has been used to scale the operations. Microsoft noted ten to fifteen distinct campaigns per day from mid-March onward, and the EU’s CERT-EU flagged at least ten tools, with EvilTokens being the most prevalent. The technique, originally linked to espionage groups such as Storm-2372, is now widely adopted by criminal actors, and Microsoft warned that 54% of recipients of AI-generated phishing links click them, far higher than the 12% rate for other attempts.