Hundreds of orgs compromised daily in Microsoft device code phishing attacks

Microsoft reports a sophisticated phishing campaign using AI and automation compromising hundreds of organizations daily since March 15, 2026. The attacks exploit device-code authentication flows to bypass MFA and access Microsoft 365, with post-compromise activity targeting financial personnel and automating email exfiltration. The campaign leverages EvilTokens, a phishing-as-a-service toolkit operational since February 2026.