Token Bingo: Don’t Let Your Code be the Winner

Executive Summary

In early April 2026, Arctic Wolf began tracking a large-scale device code phishing campaign impacting organizations across multiple regions and sectors. Similar to the widespread “Riding the Rails” campaign first observed in late March by Huntress, the threat actors were observed abusing OAuth device code flow to trick victims into providing authentication codes and obtain initial access into victim environments. The campaign leveraged phishing-as-a-service (PhaaS) infrastructure, centered on the Kali365 Live affiliate panel, and was initially traced to acti…