Threat Intelligence

Device Code Phishing Hit 344 Organisations by Hiding on Trusted Cloud Platforms

Huntress · 5 Nov 2026

Key Takeaway Do not rely on IP reputation or email filtering alone: restrict device code sign-in where you do not need it and use Conditional Access or identity monitoring to block known attacker infrastructure.

In March, Huntress analysts watched a phishing-as-a-service operation use Railway, a developer cloud platform with a clean IP reputation, to harvest sign-in tokens. Device code phishing lures reached 344 organisations across five countries in under three weeks. Because the logins came from a trusted platform, Microsoft had no reason to score them as risky. Huntress responded by building a Conditional Access policy that blocked Railway's IP ranges, checking it against 14 days of customer traffic, and pushing it to eligible Managed ITDR tenants. It stopped 305 attack attempts and affected no legitimate logins. The attackers then moved to new infrastructure.

The campaign showed how identity attacks are changing. Across the 344 victims, no two phishing lures were identical, which suggests automation or AI was writing them. The group behind it, EvilTokens, sells a storefront with AI workflows for bypassing email filters, personalising pretexts and finding inboxes that could lead to wire fraud. It even offers a 24/7 support desk.

Attackers also no longer need bulletproof hosting. They rent cheap, trusted cloud space, set up a token relay in minutes and discard it once it is burned. In one 14-day window, 5,086 distinct attacker IP addresses hit the Huntress fleet, too many to track by hand. Huntress says its new Adversary Infrastructure feature shares blocks across all tenants, stopping attackers at the Microsoft 365 sign-in before they get a session.

device code phishing Microsoft 365 identity security phishing-as-a-service Conditional Access

Summarised by CISO AI from Huntress, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.