Device Code Phishing Surge — 37x Increase Driven by EvilTokens and VENOM PhaaS Kits Targeting Microsoft 365
Device Code Phishing Surge (TL-2026-0323), also tracked as EvilTokens Campaign, is a high-severity phishing campaign, first published 2026-04-06. It is attributed to Storm-2372 (Russia) with medium confidence, affects Microsoft Microsoft 365, maps to 12 MITRE ATT&CK techniques (T1071, T1078, T1098), and is covered by 9 detection rules and 32 indicators of compromise.
Key facts for TL-2026-0323
- Threat ID
- TL-2026-0323
- Also known as
- EvilTokens Campaign, Device Code Phishing Surge 2026, ANTIBOT Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-04-06
- Last reviewed
- 2026-04-06
- Attribution
- Storm-2372
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- government, financial, healthcare, legal, construction, nonprofit, real-estate, manufacturing, defense, telecommunications, energy, higher-education
- Target regions
- North America, Europe, Oceania, Middle East, South Asia
- Detection rules
- 9
- Indicators of compromise
- 32
Malware and tooling in Device Code Phishing Surge
Malware and tooling: EvilTokens, VENOM
OAuth 2.0 Device Authorization Grant abuse has surged 37.5x in 2026, driven by EvilTokens and VENOM phishing-as-a-service kits that enable both state-sponsored and financially motivated actors to bypass MFA — including passkeys — by harvesting access and refresh tokens through legitimate Microsoft login pages. Over 340 organizations across the US, Canada, Australia, Germany, and New Zealand have been targeted, with 1,000+ phishing domains identified across 11 distinct kit families.
How Device Code Phishing Surge works
A massive escalation in device code phishing campaigns has been observed throughout early 2026, representing a 37.5x increase over baseline detection rates. The surge is primarily driven by the emergence of EvilTokens, a turnkey phishing-as-a-service (PhaaS) platform sold via Telegram, which has democratized access to OAuth 2.0 Device Authorization Grant (RFC 8628) abuse for low-skilled operators.
The attack exploits the legitimate device code authentication flow designed for input-constrained devices. Attackers initiate a POST request to Microsoft's /oauth2/v2.0/devicecode endpoint using legitimate client IDs, receiving a device_code, user_code, and verification_uri. Victims are socially engineered via email, Teams messages, or other channels to visit the legitimate Microsoft device login page and enter the attacker-supplied code. Because authentication occurs on Microsoft's real infrastructure, traditional phishing detection is ineffective. Upon victim authentication, the attacker's backend polls the token endpoint and harvests both short-lived access tokens (60-90 minutes) and long-lived refresh tokens enabling persistent account access.
Critically, this technique bypasses all forms of MFA including phishing-resistant methods such as passkeys, because the attack targets the authorization layer post-authentication. Tokens remain valid even after password resets. Using the Microsoft Authentication Broker client ID, attackers can obtain refresh tokens to register attacker-controlled devices in Entra ID, acquire Primary Refresh Tokens (PRTs), and achieve persistent organizational access.
EvilTokens, the dominant kit, features a Cloudflare Workers frontend with Railway.com backend infrastructure, anti-bot protection (X-Antibot-Token header), popup-based device code entry for reduced friction, email harvesting, reconnaissance capabilities, a built-in webmail interface, and AI-powered BEC automation. The operator (Telegram handle: _eviltokensadmin_) has announced plans to expand targeting to Gmail and Okta. VENOM, a closed-source competitor, offers both device code phishing and Adversary-in-the-Middle (AiTM) capabilities.
Push Security and Sekoia have identified 11 distinct phishing kit families: EvilTokens (ANTIBOT), SHAREFILE, CLURE, LINKID, AUTHOV, DOCUPOLL, FLOW_TOKEN, PAPRIKA, DCSTATUS, DOLCE, and VENOM. These kits leverage diverse hosting infrastructure including Cloudflare Workers, Vercel, GitHub Pages, AWS S3, Microsoft PowerApps, Tencent Cloud, and DigitalOcean, with Railway.com serving as the primary backend for EvilTokens operations.
The campaign builds on prior device code phishing activity by Storm-2372, a Russia-aligned threat actor tracked by Microsoft since August 2024, and associated groups APT29, UTA0304, UTA0307, and UNK_AcademicFlare. The current wave has expanded beyond state-sponsored espionage to include financially motivated cybercriminals conducting BEC campaigns across construction, nonprofits, real estate, manufacturing, financial services, healthcare, legal, and government sectors.
Evasion techniques include abuse of legitimate security vendor redirect services (Cisco, Trend Micro, Mimecast), multi-hop redirect chains, anti-bot protection, disabled developer tools, and infinite debugger loops. Social engineering lures impersonate Microsoft Teams, SharePoint, DocuSign, Citrix ShareFile, Adobe, and construction bid platforms.
MITRE ATT&CK techniques used in TL-2026-0323
command-and-control
T1071 Application Layer Protocol
defense-evasion
persistence
collection
credential-access
T1187 Forced Authentication; T1528 Steal Application Access Token; T1621 Multi-Factor Authentication Request Generation
execution
lateral-movement
T1550 Use Alternate Authentication Material
initial-access
resource-development
Affected products and versions in Device Code Phishing Surge
- Microsoft — Microsoft 365
Vulnerable versions: All editions with Device Code Flow enabled
Fixed in: Mitigated via Conditional Access policy blocking device code flow - Microsoft — Microsoft Entra ID
Vulnerable versions: All tenants with Device Code Flow enabled
Fixed in: Mitigated via Conditional Access policy - Microsoft — Microsoft Teams
Vulnerable versions: All versions - Microsoft — SharePoint Online
Vulnerable versions: All versions - Citrix — ShareFile
Vulnerable versions: Targeted via phishing lures - DocuSign — DocuSign
Vulnerable versions: Targeted via phishing lures - Adobe — Adobe Document Cloud
Vulnerable versions: Targeted via phishing lures
Remediation for Device Code Phishing Surge
Immediate actions
- Block device code authentication flow via Conditional Access policy in Entra ID
- Scan sign-in logs for logins originating from Railway.com IP ranges (162.220.232.0/23, 162.220.234.0/23)
- Revoke all refresh tokens for any users who authenticated via device code flow in 2026
- Block authentication from Railway infrastructure at network perimeter
- Deploy browser-level warnings for device code login URLs (login.microsoftonline.com/common/oauth2/deviceauth)
Workarounds
- Deploy Conditional Access policy in report-only mode first to identify legitimate device code usage before blocking
- Monitor for device code authentication events with mismatched IPs between authorization and subsequent activity
- Alert on unusual IP addresses initiating device code flows
Longer-term hardening
- Disable OAuth Device Authorization Grant flow for all users where not explicitly required
- Pre-create service principals requiring user assignment for first-party Microsoft apps
- Deploy in-browser phishing protection capable of detecting device code login pages
- Implement continuous token monitoring for anomalous refresh token usage patterns
- Enable comprehensive authentication logging across all device code login apps
- Conduct user awareness training on device code phishing social engineering tactics
Weaknesses (CWE) in Device Code Phishing Surge
CWE-287, CWE-294, CWE-346
Timeline of Device Code Phishing Surge
- Device code phishing technique first publicly documented as a theoretical attack vector against OAuth 2.0 Device Authorization Grant
- PhishInSuits framework released by Secureworks, providing first open-source tooling for device code phishing
- First in-the-wild device code phishing exploitation identified, attributed to Russia-linked threat actors
- Microsoft publishes Storm-2372 advisory documenting device code phishing campaign targeting governments, NGOs, IT, defense, telecom, health, education, and energy sectors
- Storm-2372 shifts to using Microsoft Authentication Broker client ID to obtain Primary Refresh Tokens and register attacker-controlled devices in Entra ID
- Early EvilTokens precursors observed using ScrapingBee-based code generation techniques
- EvilTokens introduces ANTIBOT anti-analysis code with X-Antibot-Token header for evasion
- EvilTokens production PhaaS kit launched on Telegram with Cloudflare Workers frontend and Railway.com backend, phishing pages begin circulating widely
- Campaign targeting 340+ Microsoft 365 organizations across US, Canada, Australia, New Zealand, and Germany first spotted, with Railway.com infrastructure as primary backend
- Push Security documents 15x increase in device code phishing pages compared to baseline, identifying EvilTokens as primary driver
- The Hacker News reports on campaign targeting 340+ Microsoft 365 organizations with device code phishing via OAuth abuse across five countries
- Sekoia Threat Detection & Research publishes comprehensive Part 1 analysis of EvilTokens kit, identifying 11 distinct phishing kit families and providing IOCs and YARA rules
- Push Security confirms device code phishing pages have surged to 37.5x baseline levels, with over 1,000 domains hosting EvilTokens pages across US, Australia, Canada, France, India, Switzerland, and UAE
- As of 2026-05-29, this threat remains actively exploited and escalating: the EvilTokens/VENOM device-code phishing surge has no CVE/patch (it abuses legitimate OAuth RFC 8628), no takedown or arrests occurred, and Storm-2372/APT29 stays active. An FBI warning (2026-05-26) on the successor kit Kali365 confirms the PhaaS ecosystem is expanding, mitigated only by optional Conditional Access blocks.
Sources cited for Device Code Phishing Surge
- Device code phishing attacks surge 37x as new kits spread online
- New widespread EvilTokens kit: device code phishing as-a-service — Part 1
- Push Security — Device Code Phishing Analysis
- New EvilTokens service fuels Microsoft device code phishing attacks
- Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse
- Storm-2372 conducts device code phishing campaign
- Defending against evolving identity attack techniques
- EvilTokens Emerges as New Phishing-as-a-Service Platform for Microsoft Account Takeover
- EvilTokens ramps up device code phishing targeting Microsoft 365 users
- Major Cyber Attacks in March 2026: OAuth Phishing, SVG Smuggling, Magecart, and More
Threats related to Device Code Phishing Surge
- Microsoft Entra ID Device Code Phishing — OAuth 2.0 Device Authorization Grant Abuse (Storm-2372, EvilTokens, Kali365)
- Microsoft 365 Device Code Phishing Campaign Abusing the OAuth 2.0 Device Authorization Grant Flow (EvilTokens PhaaS)
- EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code" to Breach Finance, Tech, and Managed Security Firms
- EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365
- ARToken: Business Email Compromise-as-a-Service Platform Targeting Microsoft 365 (Cisco Talos / EvilTokens Affiliate)
- New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on Microsoft 365 Accounts via OAuth Device Code Abuse and Fake PDF-Reader Credential Harvesting
Detection coverage for TL-2026-0323
As of 2026-04-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0323 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.