One hundred and sixteen thousand infected Minecraft systems sounds like a consumer story. It isn’t, and your enterprise cybersecurity stack can’t see a single one of them. WeedHack, the campaign tracked by researchers since January, ships through the cheat-loader pipeline straight onto the same home networks that host your employees’ work laptops every weeknight. Your patched EDR is doing its job. The device next to it on the family router is doing something else entirely.

That’s the uncomfortable thread running through this week’s news. Phishing-as-a-service kit Kali365 quietly expanded from Microsoft 365 to AWS, Okta, and Russian platforms, leaning hard on device code phishing that doesn’t care which machine the prompt arrives on. A new wave of fake copyright notices is hammering Chrome developers’ personal Google accounts. None of these attackers need to defeat your defense in depth strategy. They walk around it.

The compromise didn’t happen on the work laptop

Look at where attackers spent their effort in the past week. The Minecraft cheat distribution chain wormed loaders onto more than 116,000 systems running on home networks worldwide. Kali365 retooled to bypass MFA via OAuth device code flows, which work identically on a personal phone and a corporate laptop because the authorization happens out-of-band. The Google login phishing kit Malwarebytes flagged uses spoofed copyright takedown panels aimed at extension developers signed into Chrome on whatever device they happen to be using at the time.

None of these campaigns require an exploit on your managed fleet. They require an authenticated session, a refresh token, or a stored credential reachable from any device an employee owns. The work laptop’s firewall, EDR coverage, and patch cadence are irrelevant to all three. So is the brute-force protection you stood up on the corporate VPN, because nothing is being brute-forced. The attacker is signing in with a key the user handed them.

Cheat loaders, copyright takedowns, device code prompts

Three different attack types this week, one shared assumption: the user is reachable outside the corporate trust boundary, and that’s enough. WeedHack rides cheat scripts that gamers install themselves with administrator rights. The copyright phishing kit uses countdown timers and Google-branded login pages so convincing that the victim signs in willingly. Kali365’s device code flow shows the user a six-character code and tells them to paste it into a legitimate Microsoft URL. Every defense in the chain trusts the user’s choice because the user made the choice.

The common factor

All three campaigns offload the hard work onto people, and they do it in contexts where corporate security training doesn’t apply. Nobody mentions OAuth device codes at the all-hands. Nobody warns developers that copyright takedowns are an emerging phishing vector. And nobody in security training has ever suggested that a thirteen-year-old’s Minecraft launcher might be the first hop into the same VLAN as a parent’s VPN connection. The attackers picked these vectors precisely because your awareness program doesn’t cover them and your threat detection stack can’t see them.

What defenders should actually do now

The work is narrowing what an attacker can do after a non-corp device or off-hours identity is compromised. Practical steps you can take this quarter:

1. Inventory your OAuth and device code grants. Pull a report of every active token tied to corporate identities, every third-party app authorized against your IdP, and every long-lived refresh token. Revoke anything older than your stated session policy. Most teams have no idea how many of these exist.
2. Disable device code authorization where you can. If your IdP supports a conditional access rule that blocks device code flow except for whitelisted machines, turn it on. The Kali365 expansion is the warning shot, and the technique cleanly bypasses standard MFA challenges.
3. Shorten session lifetimes for high-risk roles. Developers, admins, and anyone with cloud console access should be re-authenticating multiple times per shift. A stolen refresh token valid for 90 days is a 90-day breach.
4. Treat home networks as untrusted by policy. Remote employees’ work laptops should never accept inbound connections from the local LAN, regardless of what else lives on the same router. Host-based firewall rules enforce this, not assumptions about a flat home subnet.
5. Run threat detection on identity surface, not just endpoints. Anomalous geo, impossible travel, first-seen device, and unusual app-consent events catch the off-device compromise that your EDR never witnesses. If your SIEM doesn’t ingest IdP audit logs, that’s the highest-leverage fix on the list.
6. Rehearse incident response for an out-of-band token theft. Your IR playbook probably starts with “isolate the endpoint.” Write a parallel branch for “endpoint is clean, but the identity is compromised.” That’s a different containment exercise and most teams haven’t practiced it.

None of these steps require new product spend. They require willingness to admit that the perimeter you actually defend ends well short of where attackers actually operate.

Build a cybersecurity threat model that includes the family router

The blind spot is bigger than any single campaign. Active exploitation of CVE-2025-48595 in Android Framework, patched in this month’s batch of 124 flaws, exists because a meaningful chunk of the workforce makes business decisions on a phone that’s also a personal device. Threat-protection budgets focused entirely on managed assets leave the unmanaged ones, where the breach actually starts, with no coverage. The cyber security spend follows the asset register, and the asset register doesn’t list your senior engineer’s home gaming PC or your CFO’s personal iPad.

The work to do is unglamorous. It looks like extra security hardening on identity infrastructure, tighter scopes on cloud tokens, more aggressive consent governance, and a written acknowledgment that the modern attack surface includes every device your employees touch with their corporate password. None of that shows up on a quarterly EDR coverage report. All of it matters more than the next agent you deploy on machines that were already protected.

Frequently Asked Questions

Does enterprise EDR detect malware on personal devices on the same home network?

No. EDR coverage stops at the managed endpoint. A compromised personal device on the same Wi-Fi can scan, attack, and pivot freely against any host that allows LAN traffic, including a corporate laptop with a misconfigured host firewall.

How does OAuth device code phishing bypass MFA?

The user approves a legitimate Microsoft or Okta authorization flow in a real browser session, complete with their normal MFA. The attacker’s device receives the resulting token. MFA passed; the wrong party got the keys.

What’s the fastest way to reduce exposure to these attacks?

Audit active OAuth grants and refresh tokens in your IdP, restrict or disable device code flow, and shorten session lifetimes for admin and developer roles. These three changes cost nothing and close the most exploited paths.

Sources

• Over 116,000 Minecraft systems infected in WeedHack malware campaign
• FBI-Flagged Phishing Kit Kali365 Expands Its Reach
• These convincing copyright notices are designed to steal Google logins
• Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited