EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365
EvilTokens Phishing-as-a-Service (TL-2026-0888), also tracked as EvilTokens, is a high-severity phishing campaign, first published 2026-06-20 and last reviewed 2026-07-26. It is attributed to EvilTokens PhaaS operator with medium confidence, affects Microsoft Microsoft 365 / Entra ID (OAuth 2.0 Device Authorization, maps to 44 MITRE ATT&CK techniques (T1020, T1027, T1069), and is covered by 9 detection rules and 65 indicators of compromise.
Key facts for TL-2026-0888
- Threat ID
- TL-2026-0888
- Also known as
- EvilTokens, Device Code Phishing, OAuth Device Authorization Grant Phishing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-06-20
- Last reviewed
- 2026-07-26
- Attribution
- EvilTokens PhaaS operator
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- finance, human resources, logistics, sales, construction, nonprofit, real estate, manufacturing, healthcare, legal, local government, investment
- Target regions
- North America, South America, Central America, Europe, Middle East, Asia, Oceania
- Detection rules
- 9
- Indicators of compromise
- 65
- Updates
- 2026-07-26 · 2 updates · revalidated 2× · latest source
Malware and tooling in EvilTokens Phishing-as-a-Service
Malware and tooling: EvilTokens, EvilTokens
EvilTokens is a Phishing-as-a-Service (PhaaS) kit that abuses Microsoft's legitimate OAuth 2.0 device authorization grant (RFC 8628) flow to hijack Microsoft 365 sessions without stealing passwords. Victims authenticate and complete MFA on the genuine microsoft.com/devicelogin portal but unknowingly authorize the attacker's device code, handing over valid access and refresh tokens. Launched in February 2026, the kit powered a campaign that compromised 340+ organizations across multiple countries within weeks.
How EvilTokens Phishing-as-a-Service works
EvilTokens commoditizes the device-code phishing technique pioneered in mid-2024 by the Russia-aligned actor Microsoft tracks as Storm-2372 and sells it as a turnkey Phishing-as-a-Service platform administered through a Telegram bot (operator handle 'eviltokensadmin'). The kit consists of three components: phishing pages (self-hosted or deployed on Cloudflare Workers/Pages) impersonating Microsoft, DocuSign, Adobe Acrobat Sign, OneDrive and SharePoint; a JavaScript/Node.js backend that drives the OAuth device-code flow and post-exploitation token operations; and a Telegram administration/affiliate interface that delivers harvested victim email, IP geolocation and tokens to operators.
The attack abuses RFC 8628 device authorization grant. The backend issues a POST to Microsoft's /oauth2/v2.0/devicecode endpoint using a legitimate Microsoft first-party client ID and receives a device_code, user_code and verification_uri; the user_code is valid for ~15 minutes. The victim, lured by an invoice, shared document, calendar invite, voicemail, eFax, quarantine alert, password-expiry warning or SharePoint access request, is directed to the genuine https://microsoft.com/devicelogin page and socially engineered into entering the attacker's user_code and completing authentication including MFA. The phishing page meanwhile POSTs to the kit's /api/device/start endpoint and polls /api/device/status/<sessionId> on a roughly four-second loop (guarded by a custom X-Antibot-Token header — a SHA256 of a secret, Unix timestamp and '_antibot_', validated within a 5-minute window) while the backend polls Microsoft's /common/oauth2/token endpoint. Once the victim consents, Microsoft issues an access_token (~60-90 minutes) and a refresh_token (90-day rolling) bound to the attacker's session.
Crucially, this does not bypass MFA in a technical sense — the victim completes MFA authentically on the attacker's behalf — so MFA provides no protection. When the Microsoft Authentication Broker client ID is used, the refresh token can be exchanged for a token to the device-registration service, allowing the attacker to register an attacker-controlled device in Entra ID and obtain a Primary Refresh Token (PRT). With a PRT the attacker silently authenticates to Microsoft 365 apps, bypassing credential prompts and MFA, and the kit can mint an x-ms-RefreshTokenCredential cookie for one-click browser SSO hijacking. Post-compromise, EvilTokens automates Microsoft Graph reconnaissance (/me, /organization, /users, /groups, /applications, /domains, /directoryRoles) and Azure enumeration, then enables mailbox access, file exfiltration from OneDrive/SharePoint, contact harvesting and AI-augmented business email compromise (BEC). Because refresh tokens survive password resets, remediation requires an explicit revokeSignInSessions call and removal of any rogue device registrations — a password reset alone leaves attacker access intact.
The primary technical control is a Microsoft Entra ID Conditional Access policy that blocks the device code flow (Authentication Flows condition → Device Code Flow → Grant: Block) wherever it is not operationally required.
MITRE ATT&CK techniques used in TL-2026-0888
Exfiltration
T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Defense Evasion
T1027 Obfuscated Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1684.001 Impersonation
Discovery
T1069 Permission Groups Discovery; T1087 Account Discovery; T1087.004 Cloud Account; T1526 Cloud Service Discovery
Initial Access
T1078.004 Valid Accounts: Cloud Accounts; T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link
Command and Control
T1090 Proxy; T1090.002 Proxy: External Proxy; T1102 Web Service
Persistence
T1098.001 Account Manipulation: Additional Cloud Credentials; T1098.005 Account Manipulation: Device Registration; T1137 Office Application Startup; T1546 Event Triggered Execution; T1556 Modify Authentication Process
Credential Access
T1110 Brute Force; T1187 Forced Authentication; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1606 Forge Web Credentials; T1621 Multi-Factor Authentication Request Generation
Collection
T1114.002 Email Collection: Remote Email Collection; T1213.002 Data from Information Repositories: Sharepoint; T1530 Data from Cloud Storage
Impact
Lateral Movement
lateral-movement
T1550.001 Use Alternate Authentication Material: Application Access Token; T1550.004 Use Alternate Authentication Material: Web Session Cookie
Resource Development
T1583 Acquire Infrastructure; T1583.001 Acquire Infrastructure: Domains; T1583.007 Acquire Infrastructure: Serverless; T1584.006 Compromise Infrastructure: Web Services; T1585.001 Establish Accounts: Social Media Accounts; T1588.002 Obtain Capabilities: Tool
Reconnaissance
T1589.002 Gather Victim Identity Information: Email Addresses; T1598 Phishing for Information; T1598.003 Phishing for Information: Spearphishing Link
Affected products and versions in EvilTokens Phishing-as-a-Service
- Microsoft — Microsoft 365 / Entra ID (OAuth 2.0 Device Authorization Grant)
Vulnerable versions: Tenants with device code flow enabled (default)
Fixed in: Mitigated via Conditional Access blocking device code flow - Microsoft — Exchange Online / Outlook, Teams, SharePoint, OneDrive, Microsoft Graph
Vulnerable versions: All (accessed via stolen tokens)
Remediation for EvilTokens Phishing-as-a-Service
Immediate actions
- Deploy an Entra ID Conditional Access policy that blocks the device code flow (Authentication Flows condition → Device Code Flow → Grant: Block) wherever it is not required
- Hunt Entra ID sign-in logs for authenticationProtocol=deviceCode and originalTransferMethod=deviceCodeFlow over the last 90 days
- Block the EvilTokens Railway.com IPs (162.220.234.41, 162.220.234.66, 162.220.232.57, 162.220.232.99, 162.220.232.235) via Named Locations / perimeter
- For confirmed compromises, call revokeSignInSessions for the user (password reset alone does NOT revoke refresh tokens)
Workarounds
- Block device code flow per-app where unused
- Restrict OAuth app consent to admin-approved applications
- Network-block identified EvilTokens infrastructure and the *-s-account.workers.dev pattern at proxy/CASB
Longer-term hardening
- Audit all legitimate device code flow dependencies before enforcing an org-wide block
- Require device compliance or Hybrid Azure AD Join in Conditional Access
- Enforce admin consent for OAuth application authorizations
- Monitor for new device registrations in Entra ID and alert on registrations within 48 hours of suspicious sign-ins
- Deploy phishing-resistant (FIDO2 / passkey) authentication
Weaknesses (CWE) in EvilTokens Phishing-as-a-Service
CWE-1021, CWE-451, CWE-287, CWE-290, CWE-294
Timeline of EvilTokens Phishing-as-a-Service
Showing the 20 most recent tracked events.
- Microsoft Threat Intelligence publishes analysis of the Storm-2372 device code phishing campaign and detection/mitigation guidance.
- Microsoft observes Storm-2372 shifting to the Microsoft Authentication Broker client ID to obtain refresh tokens, register attacker-controlled devices in Entra ID and acquire Primary Refresh Tokens (PRTs).
- Volexity tracks the UTA0352 cluster abusing a VSCode OAuth device-code redirect-URI variant of the technique.
- Microsoft publishes follow-up guidance, 'Defending against evolving identity attack techniques,' expanding detection and Conditional Access recommendations for device-code and related identity attacks.
- Proofpoint observes a volumetric increase in device-code phishing, including the UNK_AcademicFlare cluster's rapport-building campaigns via compromised government email addresses.
- TA2723, a high-volume financially motivated phishing actor, adopts device-code phishing as the technique's playbooks become public.
- Device-code vishing campaigns, later attributed to ShinyHunters, target Microsoft Entra and Okta SSO accounts.
- EvilTokens Phishing-as-a-Service platform launched; operator advertises via Telegram (handle eviltokensadmin).
- First EvilTokens-driven device code phishing activity observed in the wild targeting Microsoft 365 organizations in North America.
- Campaign reaches 340+ organizations across multiple countries (US, Canada, Australia, New Zealand/France, Germany, India, Switzerland, UAE) within weeks.
- Palo Alto Networks Unit 42 publishes warnings on the accelerating EvilTokens device-code phishing campaign.
- Over 1,000 domains and ~500 Cloudflare Workers pages hosting EvilTokens phishing kits confirmed via API-endpoint and URL scanning.
- Cloud Security Alliance and Sekoia (FLINT private report) publish research notes documenting the 340+ org campaign, infrastructure and IOCs.
- Sekoia publishes public blog post on the EvilTokens kit (device code phishing-as-a-service, Part 1).
- Microsoft documents an AI-enabled EvilTokens variant using dynamic device-code generation and AI-augmented BEC capabilities.
- Tycoon 2FA operators begin integrating OAuth device-code phishing into their established AiTM delivery chain, using Cloudflare Workers reputation-laundering redirectors.
- ESET WeLiveSecurity publishes consumer/enterprise advisory 'EvilTokens: the phishing that doesn't steal your password'.
- Push Security reports a 37.5x year-over-year increase in detected device-code phishing pages and catalogs 14+ distinct device-code phishing kits.
- Trend Micro publishes 'Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass,' detailing the Microsoft Authentication Broker escalation path, following a June-July 2026 DEBULL PhaaS campaign against Microsoft 365/Entra accounts.
- Cyber Security News reports a fresh wave of device-code phishing targeting legal/business professionals via law-firm-partner impersonation, Google Sites lure pages, and open-redirector chains, with hidden mailbox-rule creation and lateral phishing observed post-compromise.
Update history for TL-2026-0888
- 2026-07-26 — Device Code Phishing: OAuth Device Authorization Grant Abused to Bypass MFA and Hijack Microsoft Entra Sessions: What changed No escalation to core fields (severity HIGH, exploitability ACTIVE, status ACTIVE, attribution MEDIUM all hold). The threat's technique/ecosystem context broadens materially: device-code phishing has spread beyond EvilTokens to
- 2026-07-23 — Device-Code OAuth Phishing Steals Microsoft 365 Sessions Post-MFA (Storm-2372 / EvilTokens PhaaS Tradecraft): What changed Impact raised HIGH → CRITICAL on evidence of a July 2026 campaign wave adding durable post-compromise persistence (hidden Inbox-rule creation via New-InboxRule to suppress bounce-backs/replies) and confirmed self-propagating la
Sources cited for EvilTokens Phishing-as-a-Service
- EvilTokens: the phishing that doesn't steal your password
- New widespread EvilTokens kit: device code phishing as-a-service - Part 1
- CSA Research Note: OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations
- Hackers Abuse Microsoft OAuth Device Code Flow to Take Over Microsoft 365 Accounts
- New phishing campaign tricks employees into bypassing Microsoft 365 MFA (CSO Online)
- Storm-2372 conducts device code phishing campaign (Microsoft Security Blog)
- OAuth Device Code Phishing Campaigns Surge Targets Microsoft 365 (Infosecurity Magazine)
- Microsoft 365 Device-Code Phishing: Detection & Blocking (Hard2bit)
Threats related to EvilTokens Phishing-as-a-Service
- ARToken: Business Email Compromise-as-a-Service Platform Targeting Microsoft 365 (Cisco Talos / EvilTokens Affiliate)
- ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens PhaaS)
- EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code" to Breach Finance, Tech, and Managed Security Firms
- Device Code Phishing Surge — 37x Increase Driven by EvilTokens and VENOM PhaaS Kits Targeting Microsoft 365
- Microsoft Entra ID Device Code Phishing — OAuth 2.0 Device Authorization Grant Abuse (Storm-2372, EvilTokens, Kali365)
- Tycoon 2FA Adopts OAuth 2.0 Device-Code Phishing — PhaaS Kit Hijacks Microsoft 365 Accounts via Microsoft Authentication Broker (AppId 29d9ed98) Through Trustifi Click-Tracking and Cloudflare Workers Delivery (eSentire TRU TL-2026-0522)
Detection coverage for TL-2026-0888
As of 2026-07-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0888 across Splunk SPL, Microsoft KQL and Sigma, covering 65 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.