Device Code Phishing Surge — 37x Increase Driven by EvilTokens and VENOM PhaaS Kits Targeting Microsoft 365

Device Code Phishing Surge (TL-2026-0323), also tracked as EvilTokens Campaign, is a high-severity phishing campaign, first published 2026-04-06. It is attributed to Storm-2372 (Russia) with medium confidence, affects Microsoft Microsoft 365, maps to 12 MITRE ATT&CK techniques (T1071, T1078, T1098), and is covered by 9 detection rules and 32 indicators of compromise.

Key facts for TL-2026-0323

Threat ID
TL-2026-0323
Also known as
EvilTokens Campaign, Device Code Phishing Surge 2026, ANTIBOT Campaign
Severity
HIGH
Status
ACTIVE
Category
PHISHING
First published
2026-04-06
Last reviewed
2026-04-06
Attribution
Storm-2372
Attribution confidence
MEDIUM
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
government, financial, healthcare, legal, construction, nonprofit, real-estate, manufacturing, defense, telecommunications, energy, higher-education
Target regions
North America, Europe, Oceania, Middle East, South Asia
Detection rules
9
Indicators of compromise
32

Malware and tooling in Device Code Phishing Surge

Malware and tooling: EvilTokens, VENOM

OAuth 2.0 Device Authorization Grant abuse has surged 37.5x in 2026, driven by EvilTokens and VENOM phishing-as-a-service kits that enable both state-sponsored and financially motivated actors to bypass MFA — including passkeys — by harvesting access and refresh tokens through legitimate Microsoft login pages. Over 340 organizations across the US, Canada, Australia, Germany, and New Zealand have been targeted, with 1,000+ phishing domains identified across 11 distinct kit families.

How Device Code Phishing Surge works

A massive escalation in device code phishing campaigns has been observed throughout early 2026, representing a 37.5x increase over baseline detection rates. The surge is primarily driven by the emergence of EvilTokens, a turnkey phishing-as-a-service (PhaaS) platform sold via Telegram, which has democratized access to OAuth 2.0 Device Authorization Grant (RFC 8628) abuse for low-skilled operators.

The attack exploits the legitimate device code authentication flow designed for input-constrained devices. Attackers initiate a POST request to Microsoft's /oauth2/v2.0/devicecode endpoint using legitimate client IDs, receiving a device_code, user_code, and verification_uri. Victims are socially engineered via email, Teams messages, or other channels to visit the legitimate Microsoft device login page and enter the attacker-supplied code. Because authentication occurs on Microsoft's real infrastructure, traditional phishing detection is ineffective. Upon victim authentication, the attacker's backend polls the token endpoint and harvests both short-lived access tokens (60-90 minutes) and long-lived refresh tokens enabling persistent account access.

Critically, this technique bypasses all forms of MFA including phishing-resistant methods such as passkeys, because the attack targets the authorization layer post-authentication. Tokens remain valid even after password resets. Using the Microsoft Authentication Broker client ID, attackers can obtain refresh tokens to register attacker-controlled devices in Entra ID, acquire Primary Refresh Tokens (PRTs), and achieve persistent organizational access.

EvilTokens, the dominant kit, features a Cloudflare Workers frontend with Railway.com backend infrastructure, anti-bot protection (X-Antibot-Token header), popup-based device code entry for reduced friction, email harvesting, reconnaissance capabilities, a built-in webmail interface, and AI-powered BEC automation. The operator (Telegram handle: _eviltokensadmin_) has announced plans to expand targeting to Gmail and Okta. VENOM, a closed-source competitor, offers both device code phishing and Adversary-in-the-Middle (AiTM) capabilities.

Push Security and Sekoia have identified 11 distinct phishing kit families: EvilTokens (ANTIBOT), SHAREFILE, CLURE, LINKID, AUTHOV, DOCUPOLL, FLOW_TOKEN, PAPRIKA, DCSTATUS, DOLCE, and VENOM. These kits leverage diverse hosting infrastructure including Cloudflare Workers, Vercel, GitHub Pages, AWS S3, Microsoft PowerApps, Tencent Cloud, and DigitalOcean, with Railway.com serving as the primary backend for EvilTokens operations.

The campaign builds on prior device code phishing activity by Storm-2372, a Russia-aligned threat actor tracked by Microsoft since August 2024, and associated groups APT29, UTA0304, UTA0307, and UNK_AcademicFlare. The current wave has expanded beyond state-sponsored espionage to include financially motivated cybercriminals conducting BEC campaigns across construction, nonprofits, real estate, manufacturing, financial services, healthcare, legal, and government sectors.

Evasion techniques include abuse of legitimate security vendor redirect services (Cisco, Trend Micro, Mimecast), multi-hop redirect chains, anti-bot protection, disabled developer tools, and infinite debugger loops. Social engineering lures impersonate Microsoft Teams, SharePoint, DocuSign, Citrix ShareFile, Adobe, and construction bid platforms.

MITRE ATT&CK techniques used in TL-2026-0323

command-and-control

T1071 Application Layer Protocol

defense-evasion

T1078 Valid Accounts

persistence

T1098 Account Manipulation

collection

T1114 Email Collection

credential-access

T1187 Forced Authentication; T1528 Steal Application Access Token; T1621 Multi-Factor Authentication Request Generation

execution

T1204 User Execution

lateral-movement

T1550 Use Alternate Authentication Material

initial-access

T1566 Phishing

resource-development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities

Affected products and versions in Device Code Phishing Surge

  • Microsoft — Microsoft 365
    Vulnerable versions: All editions with Device Code Flow enabled
    Fixed in: Mitigated via Conditional Access policy blocking device code flow
  • Microsoft — Microsoft Entra ID
    Vulnerable versions: All tenants with Device Code Flow enabled
    Fixed in: Mitigated via Conditional Access policy
  • Microsoft — Microsoft Teams
    Vulnerable versions: All versions
  • Microsoft — SharePoint Online
    Vulnerable versions: All versions
  • Citrix — ShareFile
    Vulnerable versions: Targeted via phishing lures
  • DocuSign — DocuSign
    Vulnerable versions: Targeted via phishing lures
  • Adobe — Adobe Document Cloud
    Vulnerable versions: Targeted via phishing lures

Remediation for Device Code Phishing Surge

Immediate actions

  • Block device code authentication flow via Conditional Access policy in Entra ID
  • Scan sign-in logs for logins originating from Railway.com IP ranges (162.220.232.0/23, 162.220.234.0/23)
  • Revoke all refresh tokens for any users who authenticated via device code flow in 2026
  • Block authentication from Railway infrastructure at network perimeter
  • Deploy browser-level warnings for device code login URLs (login.microsoftonline.com/common/oauth2/deviceauth)

Workarounds

  • Deploy Conditional Access policy in report-only mode first to identify legitimate device code usage before blocking
  • Monitor for device code authentication events with mismatched IPs between authorization and subsequent activity
  • Alert on unusual IP addresses initiating device code flows

Longer-term hardening

  • Disable OAuth Device Authorization Grant flow for all users where not explicitly required
  • Pre-create service principals requiring user assignment for first-party Microsoft apps
  • Deploy in-browser phishing protection capable of detecting device code login pages
  • Implement continuous token monitoring for anomalous refresh token usage patterns
  • Enable comprehensive authentication logging across all device code login apps
  • Conduct user awareness training on device code phishing social engineering tactics

Weaknesses (CWE) in Device Code Phishing Surge

CWE-287, CWE-294, CWE-346

Timeline of Device Code Phishing Surge

  • Device code phishing technique first publicly documented as a theoretical attack vector against OAuth 2.0 Device Authorization Grant
  • PhishInSuits framework released by Secureworks, providing first open-source tooling for device code phishing
  • First in-the-wild device code phishing exploitation identified, attributed to Russia-linked threat actors
  • Microsoft publishes Storm-2372 advisory documenting device code phishing campaign targeting governments, NGOs, IT, defense, telecom, health, education, and energy sectors
  • Storm-2372 shifts to using Microsoft Authentication Broker client ID to obtain Primary Refresh Tokens and register attacker-controlled devices in Entra ID
  • Early EvilTokens precursors observed using ScrapingBee-based code generation techniques
  • EvilTokens introduces ANTIBOT anti-analysis code with X-Antibot-Token header for evasion
  • EvilTokens production PhaaS kit launched on Telegram with Cloudflare Workers frontend and Railway.com backend, phishing pages begin circulating widely
  • Campaign targeting 340+ Microsoft 365 organizations across US, Canada, Australia, New Zealand, and Germany first spotted, with Railway.com infrastructure as primary backend
  • Push Security documents 15x increase in device code phishing pages compared to baseline, identifying EvilTokens as primary driver
  • The Hacker News reports on campaign targeting 340+ Microsoft 365 organizations with device code phishing via OAuth abuse across five countries
  • Sekoia Threat Detection & Research publishes comprehensive Part 1 analysis of EvilTokens kit, identifying 11 distinct phishing kit families and providing IOCs and YARA rules
  • Push Security confirms device code phishing pages have surged to 37.5x baseline levels, with over 1,000 domains hosting EvilTokens pages across US, Australia, Canada, France, India, Switzerland, and UAE
  • As of 2026-05-29, this threat remains actively exploited and escalating: the EvilTokens/VENOM device-code phishing surge has no CVE/patch (it abuses legitimate OAuth RFC 8628), no takedown or arrests occurred, and Storm-2372/APT29 stays active. An FBI warning (2026-05-26) on the successor kit Kali365 confirms the PhaaS ecosystem is expanding, mitigated only by optional Conditional Access blocks.

Sources cited for Device Code Phishing Surge

Threats related to Device Code Phishing Surge

Detection coverage for TL-2026-0323

As of 2026-04-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0323 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats