EvilTokens
EvilTokens is a phishing-as-a-service (PhaaS) kit used to compromise Microsoft 365 and other Microsoft accounts by abusing Microsoft’s OAuth 2.0 device authorization grant flow. Rather than stealing credentials through a fake login page, it performs device code phishing: victims are lured to enter an attacker-generated code on Microsoft’s legitimate device login page, after which Microsoft issues access and refresh tokens to the attacker’s session. This enables account takeover even when the victim completes normal MFA, because the attacker steals session tokens rather than bypassing MFA directly.
The kit has been advertised and sold on Telegram and was observed in active attacks from at least February 2026, with Sekoia publicly uncovering it in March 2026. It has been linked to account takeover and business email compromise activity and was reported in campaigns affecting organizations worldwide, including notable activity in the United States, Canada, France, Australia, India, Switzerland, and the United Arab Emirates. Targeting has focused on employees in finance, HR, transportation/logistics, and sales.
EvilTokens uses phishing lures embedded in emails and attachments, including PDF, HTML, DOCX, XLSX, and SVG files, sometimes with QR codes or hyperlinks. Observed themes include financial documents, invoices, shared documents, SharePoint access requests, calendar invites, voicemail notices, password expiry warnings, payroll notices, logistics or purchase orders, Adobe Acrobat Sign, Adobe Acrobat Viewer, DocuSign, email quarantine notices, OneDrive shared documents, and eFax notifications. In some campaigns it was assessed to support CalPhishing-style attacks using malicious .ics calendar invites and ConsentFix/device code phishing to steal session tokens.
The phishing pages impersonate trusted services such as Adobe Acrobat, DocuSign, Microsoft 365, GoDaddy, and SharePoint, display a verification code and instructions, and redirect victims via a “Continue to Microsoft” flow to the legitimate Microsoft device login page. The Microsoft device code used in these attacks is valid for about 15 minutes. After successful authentication, attackers receive short-lived access tokens and refresh tokens that can be used to access victim email, files, Teams, SharePoint, and OneDrive data.
Sekoia reported that EvilTokens includes advanced post-compromise and automation features beyond basic phishing. Reported backend capabilities include token refresh and exchange, Primary Refresh Token conversion, browser SSO cookie generation, Outlook Web Access session generation, Microsoft Graph reconnaissance, Azure enumeration, and Telegram notifications containing victim email addresses and IP geolocation when tokens are captured. Reported API paths and detection opportunities include /api/device/start, /api/device/status/<SESSION_ID>, Cloudflare Workers naming patterns, and a custom X-Antibot-Token HTTP header. Sekoia stated that the associated infrastructure spans more than 1,000 domains.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
2 techniques
Reconnaissance
Initial Access
5 techniques
Initial Access
Seeing a valid sign-in, Microsoft issues access and refresh tokens to the session opened by the attacker. Once inside, the criminals can access corporate email, files, Teams, SharePoint, OneDrive, and other Microsoft 365 resources and exfiltrate data or prepare BEC attacks.
EvilTokens is a phishing-as-a-service (PhaaS) kit built to compromise Microsoft 365 accounts by abusing the OAuth 2.0 device authorization grant flow. As attacks that use the kit rely on device code phishing, they sidestep the need for convincing replicas of genuine login pages where the victims would hand over their passwords. | The victim receives an email or message that’s often dressed up as an invoice, shared document, calendar invite, or SharePoint access request. The lure involves a decoy page impersonating a trusted brand or service, along with simple wording such as “Verify to view” or “Signature required.”
This email contains an iCalendar (.ics) file that automatically adds a "tentative" meeting to the victim's Outlook calendar without the user needing to open the original email.
Persistence
2 techniques
Persistence
Seeing a valid sign-in, Microsoft issues access and refresh tokens to the session opened by the attacker. Once inside, the criminals can access corporate email, files, Teams, SharePoint, OneDrive, and other Microsoft 365 resources and exfiltrate data or prepare BEC attacks.
Privilege Escalation
1 technique
Privilege Escalation
Seeing a valid sign-in, Microsoft issues access and refresh tokens to the session opened by the attacker. Once inside, the criminals can access corporate email, files, Teams, SharePoint, OneDrive, and other Microsoft 365 resources and exfiltrate data or prepare BEC attacks.
Stealth
5 techniques
Stealth
Lisäksi tekoäly muuntelee viestien tekstiä ja koodia reaaliajassa, mikä auttaa niitä kiertämään perinteiset roskapostisuodattimet ja tietoturvajärjestelmät.
Prompts direct the model to reference real email threads, mask payment changes behind “plausible business reasons”, imitate sender style, and generate emails “realistic enough to fool a trained employee.”
Seeing a valid sign-in, Microsoft issues access and refresh tokens to the session opened by the attacker. Once inside, the criminals can access corporate email, files, Teams, SharePoint, OneDrive, and other Microsoft 365 resources and exfiltrate data or prepare BEC attacks.
Credential Access
6 techniques
Credential Access
...harvest Microsoft credentials and tokens in real-time, effectively allowing the threat actors to bypass multi-factor authentication (MFA).
Seeing a valid sign-in, Microsoft issues access and refresh tokens to the session opened by the attacker.
A key concern is the use of ConsentFix, or device code phishing, which allows attackers to steal session tokens, bypassing multi-factor authentication.
Since mid-February 2026, these phishing pages have been distributed in the wild and were rapidly adopted by cybercriminals specialising in Adversary-in-the-Middle (AiTM) phishing and Business Email Compromise (BEC).
Discovery
3 techniques
Discovery
The backend server then executes parallel Microsoft Graph API requests to perform reconnaissance: /contacts... /manager... /directReports... /organization
Lateral Movement
1 technique
Lateral Movement
Collection
5 techniques
Collection
Once inside, the criminals can access corporate email, files, Teams, SharePoint, OneDrive, and other Microsoft 365 resources
Employees who receive an unexpected device-code request should notify their company’s IT or security teams, who may need to review sign-in logs, revoke sessions, invalidate refresh tokens, remove malicious inbox rules, and temporarily disable the compromised account.
Finally, EvilTokens pipeline forwards all results... It also converts tokens into cookies for access to live browser sessions on Microsoft domains, bypassing passwords and MFA.
its features enable attackers to weaponise harvested tokens to exfiltrate emails, files and other sensitive data from compromised Microsoft accounts... It allegedly supports unlimited accounts and Microsoft Admin, Azure, Office, OneDrive, SharePoint and Teams applications
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
110 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A phishing-as-a-service kit used to compromise Microsoft 365 accounts through device code phishing. It abuses Microsoft’s legitimate OAuth 2.0 device authorization flow to trick victims into completing real authentication, including 2FA, for the attacker’s session, enabling account takeover, access to Microsoft 365 resources, data theft, and business email compromise.
A phishing kit believed to automate token-stealing/device code phishing activity in CalPhishing campaigns.
A phishing kit used to automate token-stealing attacks, likely supporting device code phishing workflows to capture session tokens and bypass MFA.
A device code phishing kit used to trick victims into authenticating attacker-controlled Microsoft device login requests, enabling theft of temporary access and refresh tokens for compromise of email accounts, files, Teams data, and business email compromise activity.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.