Threat reportPhishingTL-2026-0824
Microsoft 365 Device Code Phishing Campaign Abusing the OAuth 2.0 Device Authorization Grant Flow (EvilTokens PhaaS)
Microsoft 365 Device Code Phishing Campaign Abusing the (TL-2026-0824), also tracked as EvilTokens campaign, is a high-severity phishing campaign, first published 2026-06-16 and last reviewed 2026-09-27. It is attributed to Storm-2372 with high confidence, affects Microsoft Microsoft 365 / Entra ID (Azure AD), maps to 23 MITRE ATT&CK techniques (T1027, T1036, T1071), and is covered by 9 detection rules and 37 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 23MITRE ATT&CK
- Actors
- 4Storm-2372
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 37Indicators of compromise
Key facts for TL-2026-0824
- Threat ID
- TL-2026-0824
- Also known as
- EvilTokens campaign, Device Code Phishing, Storm-2372 device code phishing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- Storm-2372, APT29, UTA0304, UTA0307
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- construction, non-profit, real estate, manufacturing, financial services, healthcare, legal, government
- Target regions
- United States, Canada, Australia, New Zealand, Germany
- Detection rules
- 9
- Indicators of compromise
- 37
- Updates
- 2026-09-27 · revalidated 1× · latest source
Malware and tooling in Microsoft 365 Device Code Phishing Campaign Abusing the
Malware and tooling: EvilTokens, Graphish, SquarePhish2
How Microsoft 365 Device Code Phishing Campaign Abusing the works
An active phishing campaign abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant (device code) flow to take over Microsoft 365 / Entra ID accounts without stealing passwords. Victims are lured into entering an attacker-generated device code on the genuine Microsoft device-login page, which silently authorizes an attacker-controlled device and issues long-lived access and refresh tokens. The EvilTokens phishing-as-a-service kit relays the device code to its backend via a POST every four seconds and hides phishing keywords with invisible Unicode characters to evade signature detection.
ReversingLabs documented an active, large-scale phishing campaign that weaponizes Microsoft's OAuth 2.0 Device Authorization Grant flow — a flow normally used to log in input-constrained devices such as smart TVs and printers — to compromise Microsoft 365 accounts. Instead of harvesting credentials through a fake login page, the attacker initiates a legitimate device-code authentication, generates a short user code, and tricks the victim into entering that code on the real Microsoft endpoints (aka.ms/devicelogin, login.microsoftonline.com/common/oauth2/deviceauth, login.live.com/oauth20_remoteconnect.srf). Once the victim completes genuine Microsoft authentication (including any MFA), Microsoft's Security Token Service issues access and refresh tokens to the attacker's polling device, granting persistent access to mail and files. Because authentication occurs on real Microsoft infrastructure, the tokens survive password resets and ordinary session revocation, remaining valid for up to an hour even after refresh tokens are revoked.
The campaign is delivered by EvilTokens, a phishing-as-a-service (PhaaS) kit that debuted in February 2026; related frameworks include SquarePhish2 (QR-code device-grant automation) and Graphish. The kit landing pages are obfuscated with invisible Unicode format characters — Zero Width Space (ZWS, E2808B), Zero Width Non-Joiner (ZWNJ, E2808C) and Word Joiner (WJ, E281A0) — interspersed inside red-flag terms such as "Agreement," "Verify," and "Microsoft" to defeat keyword-based phishing classifiers. The kit's backend coordinates the OAuth flow by sending a POST to the phishing host every four seconds, carrying the device code in a URL-form-encoded "dc" parameter that is URL-safe base64-encoded; device codes embed a bitshifted "EvoStsArtifacts" string from Entra ID's Security Token Service (left-shift by six bits to recover). A Microsoft Security blog described an AI-enabled variant that dynamically regenerates the code at the final redirect (resetting the 15-minute expiry), auto-copies it via navigator.clipboard.writeText, and polls every 3-5 seconds through a checkStatus() function across thousands of short-lived nodes.
The activity has been linked to Russia-aligned operators including Storm-2372, APT29, UTA0304, UTA0307 and UNK_AcademicFlare, and was deployed against more than 340 Microsoft 365 organizations across the United States, Canada, Australia, New Zealand and Germany, spanning construction, non-profit, real estate, manufacturing, financial services, healthcare, legal and government sectors. A YARA rule, DeviceCode_Phishing_LandingPageHTML (author "Malware Utkonos," 2026-05-20), detects the kit's landing-page HTML by combining the abused login endpoints, the invisible Unicode bytes, the "dc=" artifact and the base64-encoded EvoStsArtifacts signature. Defenders should restrict the device code flow via Conditional Access, monitor Entra ID sign-in logs for device code grants from non-IoT/CLI endpoints (notably errorCode 50199 followed by success within five minutes and the Cmsi:cmsi parameter), and revoke sessions plus temporarily disable compromised accounts because access tokens persist after standard revocation.
MITRE ATT&CK techniques used in TL-2026-0824
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1550 Use Alternate Authentication Material; T1656 Impersonation
Command and Control
T1071 Application Layer Protocol; T1102 Web Service
Persistence
T1078 Valid Accounts; T1098 Account Manipulation
Discovery
T1087 Account Discovery; T1526 Cloud Service Discovery
Collection
Execution
Credential Access
T1528 Steal Application Access Token; T1606 Forge Web Credentials
stealth
T1564 Hide Artifacts; T1684.001 Impersonation
Initial Access
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1588 Obtain Capabilities
Reconnaissance
T1589 Gather Victim Identity Information; T1598 Phishing for Information
Affected products and versions in Microsoft 365 Device Code Phishing Campaign Abusing the
- Microsoft — Microsoft 365 / Entra ID (Azure AD)
Vulnerable versions: OAuth 2.0 Device Authorization Grant flow (all tenants with device code flow enabled)
Fixed in: No patch; mitigated by Conditional Access policy disabling device code flow
Remediation for Microsoft 365 Device Code Phishing Campaign Abusing the
Patches
- No software patch applies — the technique abuses legitimate OAuth 2.0 device-grant functionality; mitigation is configuration and monitoring
Immediate actions
- Block the device code flow wherever possible via Microsoft Entra Conditional Access authentication-flow policies
- Revoke user refresh tokens with the revokeSignInSessions Graph API call AND temporarily disable suspected-compromised accounts, since access tokens stay valid for up to an hour after standard revocation
- Block the listed phishing landing-page domains/URLs and threat-actor IP ranges at the email gateway, DNS resolver and web proxy
- Deploy the DeviceCode_Phishing_LandingPageHTML YARA rule on mail/web gateways to catch kit landing pages
Workarounds
- Disable the device code authentication flow for users and groups that do not require IoT/CLI logins
- Block legacy/seldom-used first-party OAuth client IDs from initiating device-code grants
Longer-term hardening
- Monitor Entra ID sign-in logs for Device Authorization Grant usage originating from non-IoT/CLI endpoints, browsers, or unexpected geographies
- Alert on errorCode 50199 followed by a successful sign-in within a 5-minute window and on the Cmsi:cmsi authentication parameter
- Enforce phishing-resistant MFA (FIDO2/passkeys) and sign-in risk policies that force re-authentication for high-risk users
- User awareness training to recognize and refuse device-code copy/paste prompts during Microsoft login
Weaknesses (CWE) in Microsoft 365 Device Code Phishing Campaign Abusing the
Timeline of Microsoft 365 Device Code Phishing Campaign Abusing the
- Microsoft publicly discloses Storm-2372's device-code phishing campaign, the earliest large-scale abuse of the OAuth device authorization grant flow against Microsoft 365/Entra ID — a distinct, unaffiliated actor whose technique EvilTokens later commoditizes.
- Storm-2992 launches the EvilTokens phishing-as-a-service platform via Telegram, the first PhaaS kit to support device-code authentication abuse at scale with integrated AI-driven lure and inbox-analysis features.
- EvilTokens phishing-as-a-service kit earliest observation in the wild.
- Device code phishing campaign abusing the OAuth Device Authorization Grant flow first spotted.
- Microsoft begins observing 10 to 15 distinct EvilTokens-driven phishing campaigns launching every 24 hours.
- Palo Alto Networks issued an alert on the device code phishing activity targeting Microsoft 365.
- Public reporting that 340+ Microsoft 365 organizations across five countries were targeted; EvilTokens PhaaS named.
- The Cloud Security Alliance publishes a research note documenting OAuth device-code phishing hitting 340+ Microsoft 365 organizations.
- Sekoia published analysis of the device code phishing infrastructure and EvilTokens kit.
- Microsoft Security published analysis of an AI-enabled device code phishing variant with dynamic code regeneration and clipboard auto-copy.
- YARA rule DeviceCode_Phishing_LandingPageHTML authored (Malware Utkonos) to detect kit landing-page HTML.
- ReversingLabs published detailed technical analysis including 300+ IOCs, the 4-second POST beacon and invisible-Unicode evasion.
- Threat documented in Threadlinqs Intelligence Platform as TL-2026-0824.
- London's Metropolitan Police Service receives information identifying two suspected EvilTokens site administrators.
- Acting on a federal court order from the U.S. District Court for the Eastern District of Virginia, Microsoft and partners seize 50 EvilTokens websites and disable 150+ supporting domains.
- The Metropolitan Police Service arrests two men, aged 32 and 38, in the UK on suspicion of administering the EvilTokens website; both are released on bail pending investigation.
- Microsoft publicly discloses the EvilTokens disruption, publishing 'Unmasking EvilTokens' and confirming 12,000+ compromised inboxes across 10,000+ organizations under the Storm-2992 attribution.
Update history for TL-2026-0824
- 2026-09-27 — EvilTokens: Storm-2992 Phishing-as-a-Service Platform Abuses OAuth Device Code Authentication Flow: What changed Attribution corrected: threat_actor Storm-2372/APT29 → Storm-2992 (EvilTokens PhaaS operators); nation_state Russia → Unknown; motivation ESPIONAGE → FINANCIAL; attribution_confidence MEDIUM → HIGH now that Microsoft's own DCU
Sources cited for Microsoft 365 Device Code Phishing Campaign Abusing the
- Microsoft 365 device code phishing campaign bypasses password stealing
- Microsoft 365 Device Code Phishing Campaign Bypasses Password Theft With Legitimate Login Flow
- Inside an AI-enabled device code phishing campaign
- Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse
- EvilTokens: PhaaS Kit Abusing OAuth Device Code Flow on Microsoft 365
- OAuth Device Code Phishing Campaigns Surge Targets Microsoft 365
- AI-enabled device code phishing campaign exploits OAuth flow for account takeover
- Hackers Abuse Microsoft OAuth Device Code Flow to Take Over Microsoft 365 Accounts
Detection coverage for TL-2026-0824
As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0824 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.