EvilTokens Scales AI-Driven Microsoft 365 Token Phishing via Device Code OAuth

The phishing-as-a-service platform EvilTokens sharply expanded attacks against Microsoft 365 accounts by abusing Microsoft’s legitimate device code OAuth flow to steal access tokens after victims completed real Microsoft logins and multi-factor authentication. Huntress reported a 1,380% increase in device code phishing activity between late 2025 and early 2026, with campaigns affecting hundreds of organizations. The operation used AI-generated personalized phishing lures and automated post-compromise analysis to support follow-on business email compromise, while relying on legitimate cloud services including Railway, BL Networks/BitLaunch, and Cloudflare Workers to blend in with normal traffic.

EvilTokens was marketed openly on Telegram as a subscription service priced from $600 to $1,500, lowering the barrier for less sophisticated criminals to launch token-theft campaigns that can bypass MFA protections. Huntress said 57.5% of observed attacks were tied to Railway or BL Networks infrastructure, and that blocking Railway IP addresses through Conditional Access prevented more than 600 incidents before attackers shifted hosting. Defenders were urged to restrict or block device code authentication where possible, review sign-in logs for suspicious Railway-originated authentications, revoke stolen tokens, audit Microsoft Graph API activity, and update user awareness training because genuine Microsoft login pages can still be part of a phishing attack.