EvilTokens Device Code Phishing Uses Notion Lures to Steal Microsoft 365 Tokens

Researchers reported that the EvilTokens phishing-as-a-service platform is being used to steal Microsoft 365 access tokens through OAuth device code phishing, with one campaign abusing free Notion accounts and malicious PDFs to lure victims. In the activity tracked as Doubloon Dredger, attackers sent legitimate-looking Notion document-sharing notifications from compromised accounts impersonating senior executives, then redirected targets to phishing pages disguised as Adobe Acrobat authentication prompts. Victims were instructed to enter a verification code on Microsoft’s legitimate sign-in or device code page, allowing Microsoft to issue authorization tokens directly to the attackers without requiring password theft.

The operation has targeted organizations in manufacturing, telecommunications, retail, healthcare, and logistics, and researchers said EvilTokens has been active since at least February 2026 and is marketed largely through Telegram. Flare said the platform goes beyond session theft by analyzing compromised mailboxes, using AI to summarize content and identify likely fraud opportunities, and helping operators craft tailored business email compromise messages based on real payment workflows and relationships. Reported activity included a 16-day wave affecting 344 organizations across five countries, while separate research found more than 1,000 infrastructure-related search results and 66 email attachments leading to EvilTokens pages; defenders were urged to restrict or disable device-code authentication where possible and monitor for anomalous token grants, inbox rule creation, mailbox searches, token reuse, and suspicious outbound email.