AI-Powered Phishing Kits Automate Microsoft 365 Business Email Compromise

Researchers identified two phishing-as-a-service kits, TokenLover and YaksaLover, that automate Microsoft 365 business email compromise operations and package them in multi-tenant dashboards resembling legitimate SaaS platforms. The kits combine established techniques including device-code phishing, FOCI token pivoting, Primary Refresh Token theft, ESTS cookie generation, internal phishing, and persistence through synthetic Windows Hello for Business key registration, allowing less-skilled operators to run full BEC campaigns at scale.

TokenLover is designed for post-compromise automation, using AI to analyze mailboxes, map payment workflows, and support invoice fraud, while YaksaLover emphasizes campaign deployment, token harvesting, and real-time email forwarding from compromised accounts. Because phishing messages can be sent from victims’ genuine Microsoft 365 accounts, they may pass SPF and DKIM checks and appear as legitimate internal mail, and researchers warned that the Windows Hello persistence mechanism can survive password resets unless organizations fully revoke device identities, keys, and active sessions.