Talos details ARToken, a PhaaS panel tied to EvilTokens that supports device code phishing, BEC workflows, SharePoint theft, ...

Device code phishing is not new, with multiple threat actors having used this method to breach accounts in the past. In February 2025, the Microsoft Threat Intelligence Center warned that Russian ...

Device code phishing attacks that abuse the OAuth 2.0 Device Authorization Grant flow to hijack accounts have surged more than 37 times this year. In this type of attack, the threat actor sends a ...