AI-turbocharged fraud learned from Russian spies has increased fourteenfold

An online fraud method is spreading rapidly, allowing attackers to break into private and corporate accounts without a password, even bypassing two-factor authentication. Romania's National Cybersecurity Directorate (DNSC) published on Monday in its quarterly report, which reviews the main IT threats of the period between April and June 2026, specifically warns of this danger. According to experts, fraudsters use artificial intelligence to generate bait messages tailored to each recipient, and the method, originally used by espionage groups serving Russian interests, has now become a mass-market product of everyday cybercrime. According to data from the American cybersecurity firm Huntress, the number of such attacks rose by 1,380 percent, or roughly fourteenfold, in the first four months of 2026 compared with the second half of 2025.

The method is called device code phishing in English. It exploits a completely legitimate authentication process originally developed for devices on which it is hard to type a password, such as smart TVs or printers. Anyone who has ever logged into a streaming service on a smart TV knows the process: a short code appears on the screen, which must be entered on a phone or computer on the provider's official page, thereby authorizing the device to connect. The fraudster reverses this process: they themselves initiate the login process, then send the resulting code to the victim by email or message, under some plausible pretext, asking the person to enter it on a genuine, official login page. The victim believes they are authorizing a device, but in reality they are opening the door to their own account for the attacker. Because the login happens on the provider's genuine page and is approved by the victim themselves, the warnings of multi-factor authentication never kick in. The fraudster therefore needs neither a password nor a stolen SMS code — they simply walk in through the open door.

The explosive spread has been made possible by artificial intelligence and ready-made tools available on the criminal market. In a campaign launched on March 2, 2026, 344 companies, institutions and organizations in five countries were targeted, and according to the report no two bait messages were alike. This suggests that the attackers used artificial intelligence to personalize each one, which also renders ineffective traditional defense systems designed to filter out waves of identical-text emails. Since mid-February, a toolkit called EvilTokens has been circulating on the criminal market, with which essentially anyone can put together such an attack. According to Microsoft, ten to fifteen separate campaigns have been observed daily since March 15, while CERT-EU, the European Union institutions' cybersecurity incident response team, has identified at least ten different tools, of which EvilTokens is the most widespread. Microsoft's data also show why artificial intelligence is so dangerous in this field: 54 percent of recipients of automatically generated phishing messages clicked on the trap-laden link, compared with only 12 percent for traditional attempts.

Origin of the method

Microsoft disclosed the activity of a group called Storm-2372 in February 2025, which, according to the company's assessment, operates in Russia's interest and had already begun its attacks in August 2024. The group tried to gain access to the accounts of government institutions, civil society organizations, and players in the defense industry, healthcare, telecommunications, energy and IT sectors by sending fake meeting invitations via WhatsApp, Signal and Microsoft Teams. What was, a year and a half ago, still a sophisticated tool of a state intelligence service has by now become a mass-produced criminal service available to anyone. This is not an isolated case: methods tested in Russian intelligence operations regularly leak into everyday crime, and conversely, criminal networks are also increasingly working for the Russian services.

The basic rule of defense is simple, and anyone can follow it: never enter a login code that you did not request yourself on your own device, no matter how official the message looks or how urgent the pretext — whether it's a supposed meeting, opening a document, or an account verification. If a message asks you to enter a code on the Microsoft, Google or another provider's site, it is almost certainly a scam. IT staff at companies and institutions can also use conditional access rules in the Microsoft environment to disable device code login for users who don't need it, which is the simplest countermeasure against the attack. Because once again, the biggest weakness in IT security is not technology but trust. The fraudster doesn't break the lock — they politely ask us to open the door for them — and from now on, artificial intelligence writes a personalized, convincing text for every single victim.

Ugar