The MFA Bypass That Uses a Real Login Page: Device-Code Phishing
Barracuda Networks, Monday, November 2nd, 2026
Barracuda explains device-code phishing, which tricks users into authorizing an attacker's session through a real login page and MFA.
In device-code phishing, the attacker starts a legitimate device-code sign-in flow and sends the resulting code to an employee, often via a lure about a shared file, RFP, invoice or voicemail.
The employee enters the code on a genuine login page and may complete MFA, unknowingly approving the attacker's session.
The attacker then receives valid access and refresh tokens for email, cloud storage and other services without capturing the password.
Barracuda notes this removes the usual warning sign of a fake sign-in page and discusses how to reduce risk across the attack chain.