Anyone who has signed in to a streaming app on a smart TV by typing a short code into a phone has used a device code flow. Microsoft supports the same mechanism for Microsoft 365 accounts, and attackers have turned it against the people it was designed to help. Through 2026, ready-made Phishing-as-a-Service (PhaaS) kits such as EvilTokens, Kali365, and Tycoon2FA have put the technique within reach of almost anyone willing to pay for it.