--- title: Device Code Phishing Keeps Evolving. Here’s What to... description: Huntress reports a second wave of device code phishing attacks targeting Microsoft 365, this time originating from infrastructure tied to VPS reseller BL... canonical: https://daily.dev/posts/device-code-phishing-keeps-evolving-here-s-what-to-watch-for-sw2ik0ki0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Device Code Phishing Keeps Evolving. Here’s What to Watch For | daily.dev og:description: Huntress reports a second wave of device code phishing attacks targeting Microsoft 365, this time originating from infrastructure tied to VPS reseller BL... og:url: https://daily.dev/posts/device-code-phishing-keeps-evolving-here-s-what-to-watch-for-sw2ik0ki0 og:image: https://api.daily.dev/og/posts/sw2ik0Ki0.png og:image:alt: Device Code Phishing Keeps Evolving. Here’s What to Watch For og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Device Code Phishing Keeps Evolving. Here’s What to Watch For **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 6 min read · 0 upvotes · 0 comments ## Summary Huntress reports a second wave of device code phishing attacks targeting Microsoft 365, this time originating from infrastructure tied to VPS reseller BL Networks, following an earlier wave linked to the Railway platform and the EvilTokens phishing-as-a-service kit. Since April 2026, activity has spread across multiple IPs and subnets, with 26 critical-severity incidents across 23 identities logged between July 3-27. The core defender problem is that attackers abuse legitimate Microsoft sign-in flows and trusted-looking infrastructure to bypass controls that rely on infrastructure reputation. Recommendations include restricting device code auth where unnecessary, monitoring for successful logins from unusual autonomous systems, revoking tokens quickly, and not relying on MFA alone since no password is stolen in this attack pattern. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is device code phishing and why is it hard to detect in Microsoft 365 environments? Device code phishing abuses the legitimate Microsoft device code sign-in flow, sending users to a real Microsoft login page so no password is directly phished and MFA can still complete normally. Detection is hard because the phishing page itself looks legitimate; defenders instead have to examine surrounding context like sign-in origin, app or flow used, and whether the identity-infrastructure pairing makes sense. _Security teams tracking phishing techniques like device code abuse follow ongoing threat research on daily.dev._ ### What is BL Networks and why is it linked to Microsoft 365 phishing attacks? BL Networks, also known as BitLaunch or BLNWX, is a VPS reseller active since at least 2017 under ASN AS399629 that has been used by attackers for device code phishing against Microsoft 365 since April 2026. Activity spread from a single IP (216.203.20.95) in April to multiple IPs across subnets by May, with 26 critical incidents across 23 identities recorded between July 3-27. _Teams investigating suspicious login infrastructure can keep up with threat intel like this on daily.dev._ ### What steps should organizations take to defend against device code phishing abusing legitimate cloud infrastructure? Organizations should restrict device code authentication where not required, monitor successful sign-ins from unusual or newly suspicious autonomous systems or hosting providers, investigate clusters of UserLoggedIn events even when they don't look high risk, revoke sessions and tokens quickly once abuse is identified, and assume MFA alone is insufficient since attackers exploit legitimate auth flows rather than stealing passwords. _Practitioners hardening identity defenses against token abuse can find similar guidance via daily.dev._ ## Similar posts on daily.dev - [We Need to Talk About Device Code Phishing](https://daily.dev/posts/we-need-to-talk-about-device-code-phishing-x88bpk5tq) · Huntress Blog · 0 upvotes · 0 comments - [EvilTokens Campaign Reveals Device Code Phishing Ticks Up 1,380%, Powered by AI](https://daily.dev/posts/eviltokens-campaign-reveals-device-code-phishing-ticks-up-1-380-powered-by-ai-mreylstuo) · Security Boulevard · 0 upvotes · 0 comments - [Evil Token: AI-Enabled Device Code Phishing Campaign](https://daily.dev/posts/evil-token-ai-enabled-device-code-phishing-campaign-vbp9mzpqq) · Coralogix · 0 upvotes · 0 comments --- Tags: [#microsoft](https://daily.dev/tags/microsoft), [#authentication](https://daily.dev/tags/authentication), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/device-code-phishing-keeps-evolving-here-s-what-to-watch-for-sw2ik0ki0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Device Code Phishing Keeps Evolving. Here’s What to Watch For","url":"https://daily.dev/posts/device-code-phishing-keeps-evolving-here-s-what-to-watch-for-sw2ik0ki0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/device-code-phishing-keeps-evolving-here-s-what-to-watch-for-sw2ik0ki0"},"datePublished":"2026-08-18T16:16:32.250Z","dateModified":"2026-08-18T19:20:06.963Z","description":"Huntress reports a second wave of device code phishing attacks targeting Microsoft 365, this time originating from infrastructure tied to VPS reseller BL...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8f2be46c57154422c58b146a06558fdc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8f2be46c57154422c58b146a06558fdc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Huntress Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Huntress Blog","logo":"https://media.daily.dev/image/upload/s--kDC1MDsj--/f_auto,q_auto/v1780213277/logos/huntress-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/huntress-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/device-code-phishing-keeps-evolving-here-s-what-to-watch-for-sw2ik0ki0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"microsoft,authentication,phishing","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Huntress Blog","item":"https://daily.dev/sources/huntress-blog"},{"@type":"ListItem","position":3,"name":"Device Code Phishing Keeps Evolving. Here’s What to Watch For"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/device-code-phishing-keeps-evolving-here-s-what-to-watch-for-sw2ik0ki0#faq","mainEntity":[{"@type":"Question","name":"What is device code phishing and why is it hard to detect in Microsoft 365 environments?","acceptedAnswer":{"@type":"Answer","text":"Device code phishing abuses the legitimate Microsoft device code sign-in flow, sending users to a real Microsoft login page so no password is directly phished and MFA can still complete normally. Detection is hard because the phishing page itself looks legitimate; defenders instead have to examine surrounding context like sign-in origin, app or flow used, and whether the identity-infrastructure pairing makes sense. Security teams tracking phishing techniques like device code abuse follow ongoing threat research on daily.dev."}},{"@type":"Question","name":"What is BL Networks and why is it linked to Microsoft 365 phishing attacks?","acceptedAnswer":{"@type":"Answer","text":"BL Networks, also known as BitLaunch or BLNWX, is a VPS reseller active since at least 2017 under ASN AS399629 that has been used by attackers for device code phishing against Microsoft 365 since April 2026. Activity spread from a single IP (216.203.20.95) in April to multiple IPs across subnets by May, with 26 critical incidents across 23 identities recorded between July 3-27. Teams investigating suspicious login infrastructure can keep up with threat intel like this on daily.dev."}},{"@type":"Question","name":"What steps should organizations take to defend against device code phishing abusing legitimate cloud infrastructure?","acceptedAnswer":{"@type":"Answer","text":"Organizations should restrict device code authentication where not required, monitor successful sign-ins from unusual or newly suspicious autonomous systems or hosting providers, investigate clusters of UserLoggedIn events even when they don't look high risk, revoke sessions and tokens quickly once abuse is identified, and assume MFA alone is insufficient since attackers exploit legitimate auth flows rather than stealing passwords. Practitioners hardening identity defenses against token abuse can find similar guidance via daily.dev."}}]} ```