The Watch

The Threat

Three independent intelligence sources confirm a 37.5x surge in device code phishing in 2026, driven by at least 11 phishing-as-a-service kits that have commoditized a technique previously reserved for APT29 and Midnight Blizzard. The attack exploits OAuth 2.0's Device Authorization Grant flow — designed for smart TVs and IoT — to steal persistent OAuth tokens on entirely legitimate Microsoft login pages. The victim completes MFA normally and unknowingly grants the attacker a token that persists independently of password resets.

This isn't a vulnerability. It's a feature being abused at industrial scale — and your default Entra ID configuration permits it.

How It Works

The attacker generates a device code, wraps it in a SaaS-themed lure (document share, compliance check, IT verification), and the victim enters the code at microsoft.com/devicelogin. After normal MFA, the attacker receives an OAuth access token and refresh token. Refresh tokens provide access for weeks to months. Password resets don't invalidate them. Detection signals look like normal token grants.

Kit Landscape

Why Your Defenses Fail

Most organizations monitor credential events but not consent events. Your SIEM alerts on impossible travel for logins — does it alert on a user granting Mail.ReadWrite + Files.ReadWrite.All to an unrecognized application from an unusual location? Traditional phishing uses fake login pages your email gateway can flag; device code phishing uses real Microsoft pages. The token, once granted, provides the full scope of whatever the OAuth application requested — mail, files, directory, APIs.

Cross-Source Analysis

All three reporting sources agree on the 37.5x growth figure (attributed to Push Security research) and the MFA bypass mechanism. One source identifies 10 kits, another identifies 11 — the discrepancy is minor and likely reflects slightly different tracking windows. All sources agree EvilTokens is the most popular kit. MITRE ATT&CK mapping is consistent across sources: T1528 (Steal Application Access Token), T1566 (Phishing), T1550.001 (Use Alternate Authentication Material).

Your Response

1. Disable device code flow in Entra ID conditional access today. Navigate to Conditional Access → New Policy → Target All Users → Grant → Block for Device Code Flow. If specific use cases require it (kiosk, IoT), restrict to managed devices with compliant status only.
2. Deploy token monitoring this week. Forward OAuth token grant events to your SIEM. Build detections for: device code flow from unexpected geolocations, consent to high-privilege scopes from unrecognized apps, and refresh token usage from new IP addresses.
3. Enforce app consent governance. In Entra ID, set 'Users can consent to apps' to No. Require admin consent workflow. In Google Workspace, restrict third-party app access to approved apps only.
4. Run M365-Assess. This free PowerShell 7 tool runs 169 automated checks across Identity, Exchange, Intune, Defender, SharePoint, and Teams — aligned to CIS and CISA SCuBA benchmarks. Prioritize token issuance and conditional access findings.

The Convergence

Three separate supply chain attack campaigns landed in the same intelligence cycle, each targeting a different link in your software development chain. The cumulative message: your CI/CD pipeline, your IDE, and your AI proxy layer are all under coordinated nation-state and criminal attack.

Campaign 1: DPRK npm Ecosystem Targeting (Broader Than Axios)

Monday's advisory covered the Axios compromise. What's new: Socket Security and DCSO confirm Bluenoroff (UNC1069) is systematically targeting maintainers of Node.js, Lodash, Fastify, Mocha, and Express — packages forming the backbone of the JavaScript ecosystem. They even targeted Socket Security's CEO, Feross Aboukhadijeh. A separate OtterCookie backdoor is being spread via malicious npm packages. This is not a single-package attack — it's a campaign against the npm ecosystem's human infrastructure.

Campaign 2: TeamPCP Trivy → LiteLLM → telnyx Cascade

TeamPCP compromised Trivy's GitHub Actions on March 19 — not the scanner binary, but the CI/CD automation layer. Security scanners are granted elevated permissions by design, making them ideal credential harvesters. Stolen credentials were then used to breach LiteLLM (97M+ monthly downloads) and telnyx (~800K downloads). LiteLLM is particularly dangerous because it stores API keys for multiple LLM providers — OpenAI, Anthropic, Azure — meaning a single compromise exposes your entire AI API key inventory.

Campaign 3: UNC4736 Drift Protocol VSCode/Cursor Exploit

The most operationally sophisticated attack: DPRK's UNC4736 spent six months building credibility with Drift Protocol, depositing over $1M, onboarding an Ecosystem Vault, and conducting face-to-face meetings at conferences via third-party intermediaries. The payload: a cloned repository exploiting a VSCode/Cursor silent code execution vulnerability paired with a malicious TestFlight wallet app. Mandiant attributes this with medium-high confidence.

Your security scanner just became the attacker's credential harvester, your IDE auto-executes code on workspace open, and DPRK is spending $1M and six months to compromise a single developer. The supply chain attack cost-benefit equation has fundamentally shifted.

Your Response

1. Pin all GitHub Actions to commit SHAs, not tags. Tags are mutable — this is exactly how TeamPCP delivered the Trivy payload. Audit all workflow files this week.
2. Rotate all LLM API keys that transited LiteLLM. If your teams used LiteLLM even experimentally, every OpenAI, Anthropic, and Azure key that flowed through it is potentially compromised.
3. Harden VSCode/Cursor: enable workspace trust, disable automatic task execution on workspace open, restrict extension auto-install from cloned repos. Set task.allowAutomaticTasks: never fleet-wide.
4. Deploy npm supply chain monitoring — evaluate Elastic's open-source Supply Chain Monitor or Socket Security. Run npm audit across all projects and audit for unexpected maintainer changes on critical packages in the past 90 days.

The Research

Lyptus Research published what may be the most consequential cybersecurity finding of 2026: a quantified scaling law for AI cyberoffense capability. Across frontier models from GPT-2 through GPT-5.3 Codex, offensive cyber capability doubles every 9.8 months on the full 2019–2026 trendline. Restrict to 2024–2026 models and it compresses to 5.7 months — a superlinear acceleration.

The methodology is rigorous: 291 tasks calibrated by 10 offensive security professionals, spanning seven established benchmarks (CyBashBench, NL2Bash, InterCode CTF, NYUCTF, CyBench, CVEBench, CyberGym). MIT independently validated the trajectory using METR's framework.

What the Numbers Mean

The Proliferation Problem

The 5.7-month open-weight lag is the critical finding. Closed-source models have guardrails — usage policies, monitoring, account enforcement. Open-weight models have none of these controls. GLM-5 demonstrates that offensive capabilities diffuse into the open ecosystem on short timelines. Fine-tuning for exploit development, removing refusal behaviors, and optimizing for offensive task completion is within the capability of any moderately sophisticated threat actor. This isn't future risk — it's near-term certainty.

Corroborating Evidence

This isn't the only data point. Anthropic's MAD Bugs Initiative demonstrated Claude Opus 4.6 autonomously discovering 500+ high-severity vulnerabilities across production open-source projects. An AI agent found a 23-year-old heap buffer overflow in the Linux NFS driver that two decades of human code review missed. The asymmetry between time-to-discover (approaching zero) and time-to-patch (days to weeks) is the critical gap.

Any defensive strategy that doesn't account for exponential attacker improvement is already obsolete. AI offensive capability doubling every 5.7 months means your annual threat model review cycle produces a document that's outdated before the ink dries.

Your Response

This is strategic, not tactical — but it demands concrete action:

1. Recalibrate threat models quarterly, not annually. Assume all adversaries — including commodity cybercriminals — have access to AI tooling that automates 50% of tasks requiring 3+ hours of expert offensive work. The Lyptus data gives you citable numbers for board materials.
2. Compress your patching cadence. If your MTTR for critical CVEs exceeds 72 hours, you're exposed. CVEBench specifically measures AI's ability to weaponize published CVEs — every day a patch sits unapplied, AI-augmented attackers have a higher probability of automated exploitation.
3. Run an AI-augmented red team exercise this quarter. Use GPT-5.3 Codex or Opus 4.6 against your production attack surface. Document where AI succeeds, where it fails, and where your detection stack has gaps. This is the single highest-ROI security investment you can make right now.
4. Deploy AI-native detection. Manual SOC triage cannot match AI-speed attack generation. Evaluate AI-augmented SOAR and behavioral analytics platforms that detect AI-characteristic patterns: systematic enumeration, low-variance exploit chains, and superhuman persistence.