Executive Summary
In early April 2026, Arctic Wolf began tracking a large-scale device code phishing campaign impacting organizations across multiple regions and sectors. Similar to the widespread “Riding the Rails” campaign first observed in late March by Huntress, the threat actors were observed abusing OAuth device code flow to trick victims into providing authentication codes and obtain initia...
This report details a sophisticated phishing-as-a-service (PhaaS) campaign leveraging OAuth device code abuse, a technique that exploits legitimate authentication flows to bypass traditional security measures. The strongest version of this narrative highlights the escalating sophistication of cybercriminal ecosystems, where tooling like Kali365 Live democratizes high-impact attacks by lowering technical barriers. The campaign’s use of legitimate Microsoft infrastructure for authentication lends ...