Loading story…
Researchers identified EvilTokens as a new phishing-as-a-service platform built to hijack Microsoft 365 accounts by abusing Microsoft’s legitimate OAuth 2.0 device code authentication flow. Sold and operated through Telegram bots, the service gives affiliates phishing templates, email harvesting and reconnaissance features, automated Microsoft API interactions, webmail access, and mailbox triage capabilities. Victims are lured into entering attacker-supplied device codes on Microsoft’s real login page, allowing attackers to capture access and refresh tokens—and in some cases a Primary Refresh Token—without stealing passwords or directly defeating MFA.
Security teams linked a sharp rise in device code phishing to EvilTokens, describing it as the first known turnkey PhaaS offering dedicated Microsoft device code phishing pages and warning that it lowers the barrier for low-skill operators. More than 1,000 phishing domains were observed by late March, with campaigns affecting organizations worldwide and notable activity in the United States, Australia, Canada, France, India, Switzerland, and the United Arab Emirates; finance, HR, and transportation/logistics staff were highlighted as frequent targets. Researchers from Sekoia and Mnemonic urged defenders to disable or restrict unnecessary device code flows in Microsoft Entra ID, monitor device code grant sign-ins for anomalies, train users on device authentication abuse, and revoke refresh tokens when compromise is suspected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-01, Cisco Talos published an analysis of ARToken, a phishing-as-a-service operator panel it linked closely to the EvilTokens ecosystem through shared infrastructure patterns, identical API contracts, and matching Primary Refresh Token persistence workflows. Talos said the platform supports Microsoft 365 device code phishing and extensive post-compromise BEC operations, including token management, email access, inbox rule manipulation, SharePoint or OneDrive actions, and advanced anti-analysis protections.
On 2026-04-04, Push Security reported that device code phishing attacks abusing OAuth 2.0 Device Authorization Grant had increased 37.5 times in 2026. The researchers said EvilTokens was a major driver but identified at least 11 phishing kits using SaaS-themed lures, anti-bot protections, and cloud-hosted infrastructure, indicating broader criminal adoption of the technique.
By 2026-04-01, Sekoia reported that EvilTokens was under active development and that its author planned to add phishing pages targeting Gmail and Okta. This marked an expansion of the platform beyond Microsoft 365-focused device code phishing.
On 2026-03-31, public reports disclosed EvilTokens as a new phishing-as-a-service platform and warned of a notable increase in Microsoft 365 device code phishing tied to the toolkit. The reporting also shared mitigations such as restricting device code flows, monitoring sign-ins, and revoking refresh tokens after suspected compromise.
By 2026-03-23, researchers had observed more than 1,000 phishing domains associated with EvilTokens. Reported targeting included organizations in the United States, Australia, Canada, France, India, Switzerland, and the United Arab Emirates.
In March 2026, Sekoia's Threat Detection and Research team identified EvilTokens and, together with Mnemonic, assessed that it was helping scale device code phishing into a broader threat. Sekoia also assessed with high confidence that the platform's backend code was likely AI-generated.
By March 2026, EvilTokens was being operated through Telegram bots and used in campaigns targeting organizations worldwide, with tooling for phishing templates, reconnaissance, webmail access, and automation. The activity was linked to increased device code phishing against Microsoft 365 users, particularly affecting sectors such as finance, HR, and transportation/logistics.
In early 2026, EvilTokens emerged as a phishing-as-a-service platform built to hijack Microsoft 365 accounts by abusing Microsoft's legitimate OAuth 2.0 device code authentication flow. Researchers described it as the first known turnkey PhaaS offering dedicated Microsoft device code phishing pages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
17 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcecommunity.gurucul.com
Open sourcecyberscoop.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcesekoia.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The phishing-as-a-service platform **EvilTokens** sharply expanded attacks against Microsoft 365 accounts by abusing Microsoft’s legitimate **device code OAuth flow** to steal access tokens after victims completed real Microsoft logins and multi-factor authentication. Huntress reported a **1,380% increase** in device code phishing activity between late 2025 and early 2026, with campaigns affecting hundreds of organizations. The operation used **AI-generated personalized phishing lures** and automated post-compromise analysis to support follow-on business email compromise, while relying on legitimate cloud services including **Railway**, **BL Networks/BitLaunch**, and **Cloudflare Workers** to blend in with normal traffic. EvilTokens was marketed openly on **Telegram** as a subscription service priced from **$600 to $1,500**, lowering the barrier for less sophisticated criminals to launch token-theft campaigns that can bypass MFA protections. Huntress said **57.5%** of observed attacks were tied to Railway or BL Networks infrastructure, and that blocking Railway IP addresses through Conditional Access prevented more than **600 incidents** before attackers shifted hosting. Defenders were urged to restrict or block device code authentication where possible, review sign-in logs for suspicious Railway-originated authentications, revoke stolen tokens, audit Microsoft Graph API activity, and update user awareness training because genuine Microsoft login pages can still be part of a phishing attack.
Jun 29, 2026
Huntress reported that the **EvilTokens** phishing-as-a-service operation used Microsoft’s legitimate device code authentication flow to steal valid session tokens from users without capturing passwords or directly breaking MFA. The campaign accelerated in early March after initial alerts in late February and affected **344 organizations across five countries over 16 days**. According to Huntress and Microsoft, the operation relied on trusted cloud infrastructure hosted on Railway and phishing lures tailored to victims’ normal workflows, allowing the activity to blend in with legitimate sign-in behavior. Researchers said EvilTokens is marketed on Telegram and uses **AI-enhanced phishing** to personalize messages, evade email filtering, identify financially valuable targets, and automate follow-on fraud using context taken from compromised accounts. Because the emails, URLs, and authentication steps appeared legitimate, traditional email defenses often failed to stop the attacks. Huntress recommended behavior-based detection, stricter Conditional Access policies, monitoring for suspicious device registrations, rapid token revocation, and wider adoption of phishing-resistant MFA such as **FIDO2** security keys and passkeys.
Jun 29, 2026
A phishing campaign abused Microsoft's OAuth 2.0 **Device Authorization Grant** (`Device Code Flow`) to capture valid Microsoft account tokens without sending victims to a counterfeit login page. Victims received emails posing as legal notifications, including password-protected PDF attachments, and were funneled through phishing pages that displayed a one-time device code before directing them to the legitimate `microsoft.com/devicelogin` page. After victims entered the code and completed normal MFA on Microsoft's real site, the attackers obtained `access_token`, `refresh_token`, and `id_token` values tied to attacker-controlled applications. The stolen tokens enabled persistent access to Microsoft services including **email, OneDrive, and Teams**, allowing attackers to read messages, access files, and monitor conversations. Researchers said the activity was observed from early April to mid-May 2026 and included a Brazil-focused variant that used legitimate redirect links, including on **cacoo.com**, to add credibility to the lure chain. Defenders were urged to reject unexpected device authorization prompts, inspect redirect parameters in otherwise legitimate URLs, disable Device Code Flow in Microsoft Entra ID where it is not needed, and monitor **DeviceCodeSignIn** and anomalous sign-in activity for signs of compromise.
Jul 9, 2026