Device code phishing, which abuses the OAuth 2.0 device authorization grant to steal access tokens, has rapidly escalated from a niche red-team technique to an industrial-scale threat within six months. This method, originally designed for input-constrained devices, is now being widely exploited across various applications and use-cases. The rapid adoption and exploitation of this technique underscore a critical and fast-evolving threat to identity and access management.