Microsoft 365 Device Code Phishing Campaign Abusing the OAuth 2.0 Device Authorization Grant Flow (EvilTokens PhaaS)
Microsoft 365 Device Code Phishing Campaign Abusing the (TL-2026-0824), also tracked as EvilTokens campaign, is a high-severity phishing campaign, first published 2026-06-16. It is attributed to Storm-2372 (Russia) with medium confidence, affects Microsoft Microsoft 365 / Entra ID (Azure AD), maps to 15 MITRE ATT&CK techniques (T1027, T1036, T1071), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-0824
- Threat ID
- TL-2026-0824
- Also known as
- EvilTokens campaign, Device Code Phishing, Storm-2372 device code phishing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-06-16
- Last reviewed
- 2026-06-16
- Attribution
- Storm-2372
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- construction, non-profit, real estate, manufacturing, financial services, healthcare, legal, government
- Target regions
- United States, Canada, Australia, New Zealand, Germany
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Microsoft 365 Device Code Phishing Campaign Abusing the
Malware and tooling: EvilTokens, Graphish, SquarePhish2
An active phishing campaign abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant (device code) flow to take over Microsoft 365 / Entra ID accounts without stealing passwords. Victims are lured into entering an attacker-generated device code on the genuine Microsoft device-login page, which silently authorizes an attacker-controlled device and issues long-lived access and refresh tokens. The EvilTokens phishing-as-a-service kit relays the device code to its backend via a POST every four seconds and hides phishing keywords with invisible Unicode characters to evade signature detection.
How Microsoft 365 Device Code Phishing Campaign Abusing the works
ReversingLabs documented an active, large-scale phishing campaign that weaponizes Microsoft's OAuth 2.0 Device Authorization Grant flow — a flow normally used to log in input-constrained devices such as smart TVs and printers — to compromise Microsoft 365 accounts. Instead of harvesting credentials through a fake login page, the attacker initiates a legitimate device-code authentication, generates a short user code, and tricks the victim into entering that code on the real Microsoft endpoints (aka.ms/devicelogin, login.microsoftonline.com/common/oauth2/deviceauth, login.live.com/oauth20_remoteconnect.srf). Once the victim completes genuine Microsoft authentication (including any MFA), Microsoft's Security Token Service issues access and refresh tokens to the attacker's polling device, granting persistent access to mail and files. Because authentication occurs on real Microsoft infrastructure, the tokens survive password resets and ordinary session revocation, remaining valid for up to an hour even after refresh tokens are revoked.
The campaign is delivered by EvilTokens, a phishing-as-a-service (PhaaS) kit that debuted in February 2026; related frameworks include SquarePhish2 (QR-code device-grant automation) and Graphish. The kit landing pages are obfuscated with invisible Unicode format characters — Zero Width Space (ZWS, E2808B), Zero Width Non-Joiner (ZWNJ, E2808C) and Word Joiner (WJ, E281A0) — interspersed inside red-flag terms such as "Agreement," "Verify," and "Microsoft" to defeat keyword-based phishing classifiers. The kit's backend coordinates the OAuth flow by sending a POST to the phishing host every four seconds, carrying the device code in a URL-form-encoded "dc" parameter that is URL-safe base64-encoded; device codes embed a bitshifted "EvoStsArtifacts" string from Entra ID's Security Token Service (left-shift by six bits to recover). A Microsoft Security blog described an AI-enabled variant that dynamically regenerates the code at the final redirect (resetting the 15-minute expiry), auto-copies it via navigator.clipboard.writeText, and polls every 3-5 seconds through a checkStatus() function across thousands of short-lived nodes.
The activity has been linked to Russia-aligned operators including Storm-2372, APT29, UTA0304, UTA0307 and UNK_AcademicFlare, and was deployed against more than 340 Microsoft 365 organizations across the United States, Canada, Australia, New Zealand and Germany, spanning construction, non-profit, real estate, manufacturing, financial services, healthcare, legal and government sectors. A YARA rule, DeviceCode_Phishing_LandingPageHTML (author "Malware Utkonos," 2026-05-20), detects the kit's landing-page HTML by combining the abused login endpoints, the invisible Unicode bytes, the "dc=" artifact and the base64-encoded EvoStsArtifacts signature. Defenders should restrict the device code flow via Conditional Access, monitor Entra ID sign-in logs for device code grants from non-IoT/CLI endpoints (notably errorCode 50199 followed by success within five minutes and the Cmsi:cmsi parameter), and revoke sessions plus temporarily disable compromised accounts because access tokens persist after standard revocation.
MITRE ATT&CK techniques used in TL-2026-0824
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Command and Control
T1071 Application Layer Protocol; T1102 Web Service
Persistence
Collection
Credential Access
T1528 Steal Application Access Token; T1606 Forge Web Credentials
stealth
T1564 Hide Artifacts; T1684.001 Impersonation
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities
Reconnaissance
T1589 Gather Victim Identity Information; T1598 Phishing for Information
Affected products and versions in Microsoft 365 Device Code Phishing Campaign Abusing the
- Microsoft — Microsoft 365 / Entra ID (Azure AD)
Vulnerable versions: OAuth 2.0 Device Authorization Grant flow (all tenants with device code flow enabled)
Fixed in: No patch; mitigated by Conditional Access policy disabling device code flow
Remediation for Microsoft 365 Device Code Phishing Campaign Abusing the
Patches
- No software patch applies — the technique abuses legitimate OAuth 2.0 device-grant functionality; mitigation is configuration and monitoring
Immediate actions
- Block the device code flow wherever possible via Microsoft Entra Conditional Access authentication-flow policies
- Revoke user refresh tokens with the revokeSignInSessions Graph API call AND temporarily disable suspected-compromised accounts, since access tokens stay valid for up to an hour after standard revocation
- Block the listed phishing landing-page domains/URLs and threat-actor IP ranges at the email gateway, DNS resolver and web proxy
- Deploy the DeviceCode_Phishing_LandingPageHTML YARA rule on mail/web gateways to catch kit landing pages
Workarounds
- Disable the device code authentication flow for users and groups that do not require IoT/CLI logins
- Block legacy/seldom-used first-party OAuth client IDs from initiating device-code grants
Longer-term hardening
- Monitor Entra ID sign-in logs for Device Authorization Grant usage originating from non-IoT/CLI endpoints, browsers, or unexpected geographies
- Alert on errorCode 50199 followed by a successful sign-in within a 5-minute window and on the Cmsi:cmsi authentication parameter
- Enforce phishing-resistant MFA (FIDO2/passkeys) and sign-in risk policies that force re-authentication for high-risk users
- User awareness training to recognize and refuse device-code copy/paste prompts during Microsoft login
Weaknesses (CWE) in Microsoft 365 Device Code Phishing Campaign Abusing the
CWE-1390, CWE-290, CWE-451
Timeline of Microsoft 365 Device Code Phishing Campaign Abusing the
- EvilTokens phishing-as-a-service kit earliest observation in the wild.
- Device code phishing campaign abusing the OAuth Device Authorization Grant flow first spotted.
- Palo Alto Networks issued an alert on the device code phishing activity targeting Microsoft 365.
- Public reporting that 340+ Microsoft 365 organizations across five countries were targeted; EvilTokens PhaaS named.
- Sekoia published analysis of the device code phishing infrastructure and EvilTokens kit.
- Microsoft Security published analysis of an AI-enabled device code phishing variant with dynamic code regeneration and clipboard auto-copy.
- YARA rule DeviceCode_Phishing_LandingPageHTML authored (Malware Utkonos) to detect kit landing-page HTML.
- ReversingLabs published detailed technical analysis including 300+ IOCs, the 4-second POST beacon and invisible-Unicode evasion.
- Threat documented in Threadlinqs Intelligence Platform as TL-2026-0824.
Sources cited for Microsoft 365 Device Code Phishing Campaign Abusing the
- Microsoft 365 device code phishing campaign bypasses password stealing
- Microsoft 365 Device Code Phishing Campaign Bypasses Password Theft With Legitimate Login Flow
- Inside an AI-enabled device code phishing campaign
- Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse
- EvilTokens: PhaaS Kit Abusing OAuth Device Code Flow on Microsoft 365
- OAuth Device Code Phishing Campaigns Surge Targets Microsoft 365
- AI-enabled device code phishing campaign exploits OAuth flow for account takeover
- Hackers Abuse Microsoft OAuth Device Code Flow to Take Over Microsoft 365 Accounts
Threats related to Microsoft 365 Device Code Phishing Campaign Abusing the
- Microsoft Entra ID Device Code Phishing — OAuth 2.0 Device Authorization Grant Abuse (Storm-2372, EvilTokens, Kali365)
- Device Code Phishing Surge — 37x Increase Driven by EvilTokens and VENOM PhaaS Kits Targeting Microsoft 365
- ARToken PhaaS Platform Exposes EvilTokens-Affiliated Microsoft 365 Device Code Phishing Toolkit
- EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to Compromise Microsoft 365 Accounts
- New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on Microsoft 365 Accounts via OAuth Device Code Abuse and Fake PDF-Reader Credential Harvesting
- EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365
Detection coverage for TL-2026-0824
As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0824 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.