Microsoft 365 Device Code Phishing Campaign Abusing the OAuth 2.0 Device Authorization Grant Flow (EvilTokens PhaaS) — Threadlinqs Intelligence
As of 2026-06-16, Microsoft 365 Device Code Phishing Campaign Abusing the OAuth 2.0 Device Authorization Grant Flow (EvilTokens PhaaS) is a high-severity phishing threat attributed to Storm-2372 (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-0824 · Severity: HIGH · Status: ACTIVE · Category: PHISHING
Attribution: Storm-2372 · Russia · ESPIONAGE
An active phishing campaign abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant (device code) flow to take over Microsoft 365 / Entra ID accounts without stealing passwords. Victims are
ReversingLabs documented an active, large-scale phishing campaign that weaponizes Microsoft's OAuth 2.0 Device Authorization Grant flow — a flow normally used to log in input-constrained devices such as smart TVs and printers — to compromise Microsoft 365 accounts. Instead of harvesting credentials through a fake login page, the attacker initiates a legitimate device-code authentication, generates a short user code, and tricks the victim into entering that code on the real Microsoft endpoints (aka.ms/devicelogin, login.microsoftonline.com/common/oauth2/deviceauth, login.live.com/oauth20_remoteconnect.srf). Once the victim completes genuine Microsoft authentication (including any MFA), Microsoft's Security Token Service issues access and refresh tokens to the attacker's polling device, granting persistent access to mail and files. Because authentication occurs on real Microsoft infrastructure, the tokens survive password resets and ordinary session revocation, remaining valid for up to an hour even after refresh tokens are revoked.
The campaign is delivered by EvilTokens, a phishing-as-a-service (PhaaS) kit that debuted in February 2026; related frameworks include SquarePhish2 (QR-code device-grant automation) and Graphish. The kit landing pages are obfuscated with invisible Unicode format characters — Zero Width Space (ZWS, E2808B), Zero Width Non-Joiner (ZWNJ, E2808C) and Word Joiner (WJ, E281A0) — interspersed inside red-flag terms such as "Agreement," "Verify," and "Microsoft" to defeat keyword-based phishing classifiers. The kit's backend coordinates the OAuth flow by sending a POST to the phishing host every four seconds, carrying the device code in a URL-form-encoded "dc" parameter that is URL-safe base64-encoded; device codes embed a bitshifted "EvoStsArtifacts" string from Entra ID's Security Token Service (left-shift by six bits to recover). A Microsoft Security blog described an AI-enabled variant that dynamically regenerates the code at the final redirect (resetting the 15-minute expiry), auto-copies it via navigator.clipboard.writeText, and polls every 3-5 seconds through a checkStatus() function across thousands of short-lived nodes.
The activity has been linked to Russia-aligned operators including Storm-2372, APT29, UTA0304, UTA0307 and UNK_AcademicFlare, and was deployed against more than 340 Microsoft 365 organizations across the United States, Canada, Australia, New Zealand and Germany, spanning construction, non-profit, real estate, manufacturing, financial services, healthcare, legal and government sectors. A YARA rule, DeviceCode_Phishing_LandingPageHTML (author "Malware Utkonos," 2026-05-20), detects the kit's landing-page HTML by combining the abused login endpoints, the invisible Unicode bytes, the "dc=" artifact and the base64-encoded EvoStsArtifacts signature. Defenders should restrict the device code flow via Conditional Access, monitor Entra ID sign-in logs for device code grants from non-IoT/CLI endpoints (notably errorCode 50199 followed by success within five minutes and the Cmsi:cmsi parameter), and revoke sessions plus temporarily disable compromised accounts because access tokens persist after standard revocation.
Weaknesses (CWE)
CWE-1390, CWE-290, CWE-451
Target sectors: construction, non-profit, real estate, manufacturing, financial services, healthcare, legal, government
Target regions: United States, Canada, Australia, New Zealand, Germany
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1589, T1598, T1583, T1583, T1588, T1566, T1566, T1528, T1606, T1036