# Device Code Phishing Surge — 37x Increase Driven by EvilTokens and VENOM PhaaS Kits Targeting Microsoft 365

> OAuth 2.0 Device Authorization Grant abuse has surged 37.5x in 2026, driven by EvilTokens and VENOM phishing-as-a-service kits that enable both state-sponsored and financially motivated actors to bypass MFA — including passkeys — by harvesting access and refresh tokens through legitimate Microsoft login pages. Over 340 organizations across the US, Canada, Australia, Germany, and New Zealand have been targeted, with 1,000+ phishing domains identified across 11 distinct kit families.

- **Published:** 2026-04-06T12:00:00Z
- **Last reviewed:** 2026-10-22T15:34:12.688Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0323
- **ID:** TL-2026-0323
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Storm-2372 (Russia)
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

A massive escalation in device code phishing campaigns has been observed throughout early 2026, representing a 37.5x increase over baseline detection rates. The surge is primarily driven by the emergence of EvilTokens, a turnkey phishing-as-a-service (PhaaS) platform sold via Telegram, which has democratized access to OAuth 2.0 Device Authorization Grant (RFC 8628) abuse for low-skilled operators.

The attack exploits the legitimate device code authentication flow designed for input-constrained devices. Attackers initiate a POST request to Microsoft's /oauth2/v2.0/devicecode endpoint using legitimate client IDs, receiving a device_code, user_code, and verification_uri. Victims are socially engineered via email, Teams messages, or other channels to visit the legitimate Microsoft device login page and enter the attacker-supplied code. Because authentication occurs on Microsoft's real infrastructure, traditional phishing detection is ineffective. Upon victim authentication, the attacker's backend polls the token endpoint and harvests both short-lived access tokens (60-90 minutes) and long-lived refresh tokens enabling persistent account access.

Critically, this technique bypasses all forms of MFA including phishing-resistant methods such as passkeys, because the attack targets the authorization layer post-authentication. Tokens remain valid even after password resets. Using the Microsoft Authentication Broker client ID, attackers can obtain refresh tokens to register attacker-controlled devices in Entra ID, acquire Primary Refresh Tokens (PRTs), and achieve persistent organizational access.

EvilTokens, the dominant kit, features a Cloudflare Workers frontend with Railway.com backend infrastructure, anti-bot protection (X-Antibot-Token header), popup-based device code entry for reduced friction, email harvesting, reconnaissance capabilities, a built-in webmail interface, and AI-powered BEC automation. The operator (Telegram handle: _eviltokensadmin_) has announced plans to expand targeting to Gmail and Okta. VENOM, a closed-source competitor, offers both device code phishing and Adversary-in-the-Middle (AiTM) capabilities.

Push Security and Sekoia have identified 11 distinct phishing kit families: EvilTokens (ANTIBOT), SHAREFILE, CLURE, LINKID, AUTHOV, DOCUPOLL, FLOW_TOKEN, PAPRIKA, DCSTATUS, DOLCE, and VENOM. These kits leverage diverse hosting infrastructure including Cloudflare Workers, Vercel, GitHub Pages, AWS S3, Microsoft PowerApps, Tencent Cloud, and DigitalOcean, with Railway.com serving as the primary backend for EvilTokens operations.

The campaign builds on prior device code phishing activity by Storm-2372, a Russia-aligned threat actor tracked by Microsoft since August 2024, and associated groups APT29, UTA0304, UTA0307, and UNK_AcademicFlare. The current wave has expanded beyond state-sponsored espionage to include financially motivated cybercriminals conducting BEC campaigns across construction, nonprofits, real estate, manufacturing, financial services, healthcare, legal, and government sectors.

Evasion techniques include abuse of legitimate security vendor redirect services (Cisco, Trend Micro, Mimecast), multi-hop redirect chains, anti-bot protection, disabled developer tools, and infinite debugger loops. Social engineering lures impersonate Microsoft Teams, SharePoint, DocuSign, Citrix ShareFile, Adobe, and construction bid platforms.

## MITRE ATT&CK

- T1566 Phishing
- T1621 Multi-Factor Authentication Request Generation
- T1528 Steal Application Access Token
- T1550 Use Alternate Authentication Material
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1114 Email Collection
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1204 User Execution
- T1071 Application Layer Protocol
- T1187 Forced Authentication
- T1564.008 Hide Artifacts
- T1656 Impersonation

## Sources

- [Device code phishing attacks surge 37x as new kits spread online](https://www.bleepingcomputer.com/news/security/device-code-phishing-attacks-surge-37x-as-new-kits-spread-online/)
- [New widespread EvilTokens kit: device code phishing as-a-service — Part 1](https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/)
- [Push Security — Device Code Phishing Analysis](https://pushsecurity.com/blog/device-code-phishing/)
- [New EvilTokens service fuels Microsoft device code phishing attacks](https://www.bleepingcomputer.com/news/security/new-eviltokens-service-fuels-microsoft-device-code-phishing-attacks/)
- [Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse](https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Defending against evolving identity attack techniques](https://www.microsoft.com/en-us/security/blog/2025/05/29/defending-against-evolving-identity-attack-techniques/)
- [EvilTokens Emerges as New Phishing-as-a-Service Platform for Microsoft Account Takeover](https://cybersecuritynews.com/eviltokens-emerges-as-new-phishing-as-a-service-platform/)
- [EvilTokens ramps up device code phishing targeting Microsoft 365 users](https://www.helpnetsecurity.com/2026/03/31/eviltokens-phishing-microsoft-365/)
- [Major Cyber Attacks in March 2026: OAuth Phishing, SVG Smuggling, Magecart, and More](https://www.hendryadrian.com/major-cyber-attacks-in-march-2026-oauth-phishing-svg-smuggling-magecart-and-more/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0323