EvilTokens device-code phishing hit 344 orgs; passkey-themed lures bypass passkeys via other auth flows
Huntress argues that passkeys raise the bar for authentication but do not close the account lifecycle: attackers still target enrollment, recovery, compromised endpoints, alternative sign-in flows and social engineering. Huntress researchers tracked a device-code phishing campaign, EvilTokens, that hit 344 organizations across five countr…