MalwareUsed by 2 actors

EvilTokens

EvilTokens is a phishing-as-a-service platform focused on compromising Microsoft 365 accounts by abusing the OAuth 2.0 Device Authorization Grant flow. Rather than stealing passwords through counterfeit login pages, it tricks victims into entering an attacker-generated Microsoft device code on Microsoft’s legitimate device login portal and completing normal authentication, including MFA. This causes Microsoft to issue access and refresh tokens to the attacker’s session, enabling account takeover without direct credential theft and reducing many traditional phishing indicators.

The platform has been active since at least early 2026 and has been sold through Telegram-based criminal channels on a subscription model. It provides turnkey phishing infrastructure, lure templates, token handling, and post-compromise workflows that lower the barrier to entry for affiliates. Observed lures impersonate common business workflows such as invoices, shared documents, signature requests, voicemail notices, calendar invites, password expiry notices, and SharePoint or OneDrive access requests. Delivery has been observed through phishing emails and malicious document attachments or links, including formats such as PDF, HTML, DOCX, XLSX, and SVG.

EvilTokens is associated with campaigns targeting Microsoft 365 and Entra ID environments globally, with repeated targeting of finance, human resources, logistics, sales, and accounts-payable personnel to support business email compromise and fraud operations. Reported post-compromise capabilities include token refresh, conversion of stolen authentication material into Primary Refresh Tokens for persistence, browser single sign-on hijacking, Outlook Web Access session generation, Microsoft Graph and Azure reconnaissance, and access to email, Teams, SharePoint, and OneDrive data. Operators have used compromised access for mailbox monitoring, data theft, and business email compromise activity, and related ecosystems have shown the ability to create inbox rules and maintain access after password changes.

EvilTokens has also been linked to a broader affiliate ecosystem. ARToken has been assessed as an affiliate panel or closely related offshoot sharing infrastructure, API contracts, deployment patterns, and token-management workflows with EvilTokens, indicating maturation from a phishing kit into a broader service platform for scalable Microsoft 365 intrusion and follow-on abuse.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Storm-2372

BGD e-GOV CIRT is issuing this advisory to raise awareness of EvilTokens, a Phishing-as-a-Service (PhaaS) kit that abuses the legitimate Microsoft OAuth 2.0 Device Authorization Grant (device code) flow to steal persistent Microsoft 365 access and refresh tokens without requiring password theft or triggering suspicious MFA prompts.

via bgd e gov cirt product advisoriescirt.gov.bd

TA4903

via bgd e gov cirt product advisoriescirt.gov.bd

MITRE ATT&CK

Techniques & procedures

29 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

3 techniques

T1589Gather Victim Identity InformationEvidence1

Threat actors query Microsoft’s GetCredentialType endpoint to confirm a targeted email address exists and is active within a tenant, typically 10-15 days before the phishing attempt is launched.

T1593Search Open Websites/DomainsEvidence1

Other observed post-compromise activity: ... targeted searches for wire transfer instructions, pending invoices, and executive correspondence (i.e., business email compromise / fraud staging).

T1598Phishing for InformationEvidence2

Victims receive an email themed as an invoice, RFP, shared file, voicemail notification, e-signature request, or "Action Required: Password Expiration" notice. Generative AI is used to personalize lures to the victim’s role and organization.

Resource Development

2 techniques

T1583.006Web ServicesEvidence1

T1583.006 — Acquire Infrastructure: Web Services (Resource Development)

T1584Compromise InfrastructureEvidence1

Multiple legitimate, compromised third-party domains are also used to host intermediate redirect or landing content.

Initial Access

4 techniques

T1078Valid AccountsEvidence5

The victim is redirected to the genuine microsoft.com/devicelogin page, pastes the code, and completes their own password and MFA as normal -- unknowingly authorizing the attacker’s session.

T1566PhishingEvidence9

EvilTokens, a Phishing-as-a-Service (PhaaS) kit that abuses the legitimate Microsoft OAuth 2.0 Device Authorization Grant (device code) flow to steal persistent Microsoft 365 access and refresh tokens... The campaign employs a "ghost phishing" technique...

T1566.001Spearphishing AttachmentEvidence1

ARToken focuses on targeted social engineering attacks, allowing operators to customize phishing attempts for each victim.

T1566.002Spearphishing LinkEvidence2

T1566.002 — Phishing: Spearphishing Link (Initial Access)

Persistence

2 techniques

T1078Valid AccountsEvidence5

The victim is redirected to the genuine microsoft.com/devicelogin page, pastes the code, and completes their own password and MFA as normal -- unknowingly authorizing the attacker’s session.

T1098.001Additional Cloud CredentialsEvidence1

T1098.001 — Account Manipulation: Additional Cloud Credentials (Persistence)

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence5

The victim is redirected to the genuine microsoft.com/devicelogin page, pastes the code, and completes their own password and MFA as normal -- unknowingly authorizing the attacker’s session.

T1098.001Additional Cloud CredentialsEvidence1

T1098.001 — Account Manipulation: Additional Cloud Credentials (Persistence)

Stealth

7 techniques

T1027Obfuscated Files or InformationEvidence1

The phishing kit also “deploys a seven-layer anti-analysis system combining client-side behavioral verification with XOR-encrypted payloads...

T1036MasqueradingEvidence2

Impersonating domains observed include patterns such as graph-microsoft[.]com, portal-azure[.]com, office365-login[.]com, and randomized brand-impersonating subdomains such as a7b2-c9d4.office-verify[.]net (domain shadowing).

T1070Indicator RemovalEvidence1

inbox rule creation for forwarding and deleting messages

T1078Valid AccountsEvidence5

The victim is redirected to the genuine microsoft.com/devicelogin page, pastes the code, and completes their own password and MFA as normal -- unknowingly authorizing the attacker’s session.

T1497Virtualization/Sandbox EvasionEvidence1

The phishing kit also “deploys a seven-layer anti-analysis system combining client-side behavioral verification with XOR-encrypted payloads, a more sophisticated evasion approach...

T1564Hide ArtifactsEvidence1

inbox rule creation for forwarding and deleting messages

T1564.008Email Hiding RulesEvidence1

Création de règles de boîte de réception pour masquer ou supprimer des messages

Credential Access

2 techniques

T1528Steal Application Access TokenEvidence3

When the victim completes their own password and MFA challenge as normal, they unknowingly authorize the attacker’s session -- and the attacker’s backend receives a valid, working access token and refresh token.

T1649Steal or Forge Authentication CertificatesEvidence2

a backend broker generated and polled Microsoft Authentication Broker device-code tokens... allowing the threat actor to recover the token and hijack their account.

Discovery

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

The phishing kit also “deploys a seven-layer anti-analysis system combining client-side behavioral verification with XOR-encrypted payloads, a more sophisticated evasion approach...

T1526Cloud Service DiscoveryEvidence1

Other observed post-compromise activity: ... Microsoft Graph API reconnaissance to map organizational structure and permissions...

Lateral Movement

3 techniques

T1534Internal SpearphishingEvidence1

Automatisation des opérations de Business Email Compromise (BEC)

T1550Use Alternate Authentication MaterialEvidence1

ARToken functions as a complete post-compromise toolkit that allows operators to leverage the captured access token recovered following successful device code authentication to maintain access.

T1550.001Application Access TokenEvidence2

T1550.001 — Use Alternate Authentication Material: Application Access Token (Defense Evasion)

Collection

4 techniques

T1114Email CollectionEvidence2

Other observed post-compromise activity: creation of malicious inbox rules for silent mail exfiltration...

T1114.002Remote Email CollectionEvidence1

Accès complet aux boîtes Outlook ... Surveillance simultanée de plusieurs boîtes compromises par mots-clés

T1114.003Email Forwarding RuleEvidence2

Other observed post-compromise activity: creation of malicious inbox rules for silent mail exfiltration...

T1115Clipboard DataEvidence1

The script automatically copies the generated device code to the victim’s clipboard via navigator.clipboard.writeText.

Exfiltration

2 techniques

T1567Exfiltration Over Web ServiceEvidence1

T1567 — Exfiltration Over Web Service (Exfiltration)

T1567.002Exfiltration to Cloud StorageEvidence1

ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token (PRT) persistence, email access, business email compromise (BEC) operations, and SharePoint exfiltration.

Other

1 technique

T1656ImpersonationEvidence1

the email lure abused a real vendor relationship between a US life-sciences company and a legitimate plumbing and fire-protection contractor

INDICATORS OF COMPROMISE

IOCs tracked for this family

148 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

148 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app4 days ago

domain●●●●●●●●●●●●View more in app19 days ago

domain●●●●●●●●●●●●View more in app26 days ago

domain●●●●●●●●●●●●View more in app29 days ago

ACTIVITY FEED

Recent activity

18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

18 SOURCESView more in app

knowbe4 blogNews

Jul 23, 2026

New Phishing Tools Enable Attackers to Easily Bypass Multifactor Authentication

An AI-powered phishing-as-a-service platform referenced as pairing with Jalisco to support real-time OAuth code delivery for phishing operations.

reliaquest com threat huntingNews

Jul 14, 2026

Threat Spotlight: The Jalisco Toolkit and AI-Powered Phishing Surge

An AI-powered phishing-as-a-service kit used to mirror target branding and support device code phishing campaigns at scale.

the hacker newsNews

Jul 13, 2026

Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft

A phishing kit used in device code phishing campaigns, reached through multiple redirect and infrastructure hops before presenting the phishing flow.

cyberveilleNews

Jul 8, 2026

ARToken : plateforme PhaaS affiliée à EvilTokens ciblant Microsoft 365 via device code phishing | CyberVeille

Commercial phishing platform associated with Microsoft 365 device code phishing and BEC enablement. The content describes it as a commercial PhaaS offering with similar OAuth device authorization, PRT-related endpoints, Cloudflare Workers deployment, and AI/LLM-assisted workflow for scoring mailbox value and automating BEC campaigns.

+13 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching148

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping29

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

EvilTokens