# Microsoft 365 Device Code Phishing Campaign Abusing the OAuth 2.0 Device Authorization Grant Flow (EvilTokens PhaaS)

> An active phishing campaign abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant (device code) flow to take over Microsoft 365 / Entra ID accounts without stealing passwords. Victims are lured into entering an attacker-generated device code on the genuine Microsoft device-login page, which silently authorizes an attacker-controlled device and issues long-lived access and refresh tokens. The EvilTokens phishing-as-a-service kit relays the device code to its backend via a POST every four seconds and hides phishing keywords with invisible Unicode characters to evade signature detection.

- **Published:** 2026-06-16T00:00:00Z
- **Last reviewed:** 2026-09-27T02:47:45.966Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0824
- **ID:** TL-2026-0824
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Storm-2372
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ReversingLabs documented an active, large-scale phishing campaign that weaponizes Microsoft's OAuth 2.0 Device Authorization Grant flow — a flow normally used to log in input-constrained devices such as smart TVs and printers — to compromise Microsoft 365 accounts. Instead of harvesting credentials through a fake login page, the attacker initiates a legitimate device-code authentication, generates a short user code, and tricks the victim into entering that code on the real Microsoft endpoints (aka.ms/devicelogin, login.microsoftonline.com/common/oauth2/deviceauth, login.live.com/oauth20_remoteconnect.srf). Once the victim completes genuine Microsoft authentication (including any MFA), Microsoft's Security Token Service issues access and refresh tokens to the attacker's polling device, granting persistent access to mail and files. Because authentication occurs on real Microsoft infrastructure, the tokens survive password resets and ordinary session revocation, remaining valid for up to an hour even after refresh tokens are revoked.

The campaign is delivered by EvilTokens, a phishing-as-a-service (PhaaS) kit that debuted in February 2026; related frameworks include SquarePhish2 (QR-code device-grant automation) and Graphish. The kit landing pages are obfuscated with invisible Unicode format characters — Zero Width Space (ZWS, E2808B), Zero Width Non-Joiner (ZWNJ, E2808C) and Word Joiner (WJ, E281A0) — interspersed inside red-flag terms such as "Agreement," "Verify," and "Microsoft" to defeat keyword-based phishing classifiers. The kit's backend coordinates the OAuth flow by sending a POST to the phishing host every four seconds, carrying the device code in a URL-form-encoded "dc" parameter that is URL-safe base64-encoded; device codes embed a bitshifted "EvoStsArtifacts" string from Entra ID's Security Token Service (left-shift by six bits to recover). A Microsoft Security blog described an AI-enabled variant that dynamically regenerates the code at the final redirect (resetting the 15-minute expiry), auto-copies it via navigator.clipboard.writeText, and polls every 3-5 seconds through a checkStatus() function across thousands of short-lived nodes.

The activity has been linked to Russia-aligned operators including Storm-2372, APT29, UTA0304, UTA0307 and UNK_AcademicFlare, and was deployed against more than 340 Microsoft 365 organizations across the United States, Canada, Australia, New Zealand and Germany, spanning construction, non-profit, real estate, manufacturing, financial services, healthcare, legal and government sectors. A YARA rule, DeviceCode_Phishing_LandingPageHTML (author "Malware Utkonos," 2026-05-20), detects the kit's landing-page HTML by combining the abused login endpoints, the invisible Unicode bytes, the "dc=" artifact and the base64-encoded EvoStsArtifacts signature. Defenders should restrict the device code flow via Conditional Access, monitor Entra ID sign-in logs for device code grants from non-IoT/CLI endpoints (notably errorCode 50199 followed by success within five minutes and the Cmsi:cmsi parameter), and revoke sessions plus temporarily disable compromised accounts because access tokens persist after standard revocation.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1598 Phishing for Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1566 Phishing
- T1528 Steal Application Access Token
- T1606 Forge Web Credentials
- T1036 Masquerading
- T1684.001 Impersonation
- T1027 Obfuscated Files or Information
- T1098 Account Manipulation
- T1564 Hide Artifacts
- T1114 Email Collection
- T1071 Application Layer Protocol
- T1102 Web Service
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1566 Phishing
- T1566 Phishing
- T1204 User Execution
- T1656 Impersonation
- T1550 Use Alternate Authentication Material
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1114 Email Collection
- T1114 Email Collection
- T1087 Account Discovery
- T1526 Cloud Service Discovery
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service

## Sources

- [Microsoft 365 device code phishing campaign bypasses password stealing](https://www.reversinglabs.com/blog/device-code-phishing-campaign)
- [Microsoft 365 Device Code Phishing Campaign Bypasses Password Theft With Legitimate Login Flow](https://cybersecuritynews.com/microsoft-365-device-code-phishing-campaign/)
- [Inside an AI-enabled device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/)
- [Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse](https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html)
- [EvilTokens: PhaaS Kit Abusing OAuth Device Code Flow on Microsoft 365](https://www.technadu.com/eviltokens-phaas-kit-abusing-oauth-device-code-flow-on-microsoft-365/629422/)
- [OAuth Device Code Phishing Campaigns Surge Targets Microsoft 365](https://www.infosecurity-magazine.com/news/oauth-phishing-campaigns/)
- [AI-enabled device code phishing campaign exploits OAuth flow for account takeover](https://www.helpnetsecurity.com/2026/04/07/microsoft-device-code-phishing-campaign/)
- [Hackers Abuse Microsoft OAuth Device Code Flow to Take Over Microsoft 365 Accounts](https://gbhackers.com/microsoft-oauth-device-code-abused/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0824