{"id":232341,"date":"2026-04-07T16:19:00","date_gmt":"2026-04-07T20:19:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/04\/07\/hundreds-compromised-daily-in-microsoft-device-code-phishes-the-register\/"},"modified":"2026-04-07T16:19:00","modified_gmt":"2026-04-07T20:19:00","slug":"hundreds-compromised-daily-in-microsoft-device-code-phishes-the-register","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/04\/07\/hundreds-compromised-daily-in-microsoft-device-code-phishes-the-register\/","title":{"rendered":"Hundreds compromised daily in Microsoft device code phishes \u2022 The Register"},"content":{"rendered":"

Hundreds compromised daily in Microsoft device code phishes \u2022 The Register<\/a><\/p>\n

https:\/\/www.theregister.com\/2026\/04\/07\/microsoft_device_code_phishing\/?td\\u003dkeepreading<\/a><\/p>\n

Publish Date: 2026-04-07 16:19:00<\/a><\/p>\n

Source Domain: www.theregister.com<\/a><\/p>\n

Hundreds of organizations have been compromised daily by a Microsoft device-code phishing campaign that uses AI and automation at nearly every stage of the attack chain to ultimately snoop through corporate email inboxes and steal financial data.<\/p>\n

“Since March 15, 2026, we have observed 10 to 15 distinct campaigns launching every 24 hours,” Microsoft VP of security research Tanmay Ganacharya told The Register.\u00a0<\/p>\n

“Each campaign is distributed at scale, targeting hundreds of organizations with highly varied and unique payloads, making pattern-based detection more challenging,” Ganacharya said. “We continue to observe high-volume activity, with hundreds of compromises occurring daily across affected environments.”<\/p>\n

The attackers have targeted organizations across all sectors and globally, he told us. And while the phishing expedition hasn’t been attributed to a particular crew, its tooling and infrastructure share similarities with EvilTokens.\u00a0<\/p>\n

EvilTokens is a new Microsoft device-code phishing kit that has been sold as a service since mid-February, allowing buyers to bypass multi-factor authentication (MFA) and silently authenticate as the victim to the organization’s Microsoft 365 applications. Its operators have promised to soon extend support to Gmail and Okta phishing pages.<\/p>\n

While the campaign appears to target a broad swath of organizations across all industries,\u00a0“post-compromise activity shows a consistent focus on finance-related personas, with automated email exfiltration observed in those accounts,” Ganacharya said.<\/p>\n

Redmond researchers detailed the device code attack in a Monday blog, and said that it “marks a significant escalation in threat actor sophistication.”\u00a0<\/p>\n

Device code authentication<\/h3>\n

Devices like smart TVs, printers, and other IoT devices that don’t support a standard interactive login typically…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Hundreds compromised daily in Microsoft device code phishes \u2022 The Register https:\/\/www.theregister.com\/2026\/04\/07\/microsoft_device_code_phishing\/?td\\u003dkeepreading Publish Date: 2026-04-07…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[],"class_list":["post-232341","post","type-post","status-publish","format-standard","hentry","category-cybersecurity"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/232341"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=232341"}],"version-history":[{"count":0,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/232341\/revisions"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=232341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=232341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=232341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}