EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365 — Threadlinqs Intelligence
As of 2026-07-26, EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365 is a high-severity phishing threat attributed to EvilTokens PhaaS operator (Unknown (PhaaS affiliates); technique origin assessed Russia-linked (Storm-2372, medium confidence)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 65 indicators of compromise.
Threat ID: TL-2026-0888 · Severity: HIGH · Status: ACTIVE · Category: PHISHING
Updated: 2026-07-26 · 2 updates · revalidated 2× · latest source
Attribution: EvilTokens PhaaS operator · Unknown (PhaaS affiliates); technique origin assessed Russia-linked (Storm-2372, medium confidence) · FINANCIAL
EvilTokens is a Phishing-as-a-Service (PhaaS) kit that abuses Microsoft's legitimate OAuth 2.0 device authorization grant (RFC 8628) flow to hijack Microsoft 365 sessions without stealing passwords.
EvilTokens commoditizes the device-code phishing technique pioneered in mid-2024 by the Russia-aligned actor Microsoft tracks as Storm-2372 and sells it as a turnkey Phishing-as-a-Service platform administered through a Telegram bot (operator handle 'eviltokensadmin'). The kit consists of three components: phishing pages (self-hosted or deployed on Cloudflare Workers/Pages) impersonating Microsoft, DocuSign, Adobe Acrobat Sign, OneDrive and SharePoint; a JavaScript/Node.js backend that drives the OAuth device-code flow and post-exploitation token operations; and a Telegram administration/affiliate interface that delivers harvested victim email, IP geolocation and tokens to operators.
The attack abuses RFC 8628 device authorization grant. The backend issues a POST to Microsoft's /oauth2/v2.0/devicecode endpoint using a legitimate Microsoft first-party client ID and receives a device_code, user_code and verification_uri; the user_code is valid for ~15 minutes. The victim, lured by an invoice, shared document, calendar invite, voicemail, eFax, quarantine alert, password-expiry warning or SharePoint access request, is directed to the genuine https://microsoft.com/devicelogin page and socially engineered into entering the attacker's user_code and completing authentication including MFA. The phishing page meanwhile POSTs to the kit's /api/device/start endpoint and polls /api/device/status/<sessionId> on a roughly four-second loop (guarded by a custom X-Antibot-Token header — a SHA256 of a secret, Unix timestamp and '_antibot_', validated within a 5-minute window) while the backend polls Microsoft's /common/oauth2/token endpoint. Once the victim consents, Microsoft issues an access_token (~60-90 minutes) and a refresh_token (90-day rolling) bound to the attacker's session.
Crucially, this does not bypass MFA in a technical sense — the victim completes MFA authentically on the attacker's behalf — so MFA provides no protection. When the Microsoft Authentication Broker client ID is used, the refresh token can be exchanged for a token to the device-registration service, allowing the attacker to register an attacker-controlled device in Entra ID and obtain a Primary Refresh Token (PRT). With a PRT the attacker silently authenticates to Microsoft 365 apps, bypassing credential prompts and MFA, and the kit can mint an x-ms-RefreshTokenCredential cookie for one-click browser SSO hijacking. Post-compromise, EvilTokens automates Microsoft Graph reconnaissance (/me, /organization, /users, /groups, /applications, /domains, /directoryRoles) and Azure enumeration, then enables mailbox access, file exfiltration from OneDrive/SharePoint, contact harvesting and AI-augmented business email compromise (BEC). Because refresh tokens survive password resets, remediation requires an explicit revokeSignInSessions call and removal of any rogue device registrations — a password reset alone leaves attacker access intact.
The primary technical control is a Microsoft Entra ID Conditional Access policy that blocks the device code flow (Authentication Flows condition → Device Code Flow → Grant: Block) wherever it is not operationally required.
Weaknesses (CWE)
CWE-1021, CWE-451, CWE-287, CWE-290, CWE-294
Target sectors: finance, human resources, logistics, sales, construction, nonprofit, real estate, manufacturing, healthcare, legal, local government, investment
Target regions: North America, South America, Central America, Europe, Middle East, Asia, Oceania
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 65 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1583, T1583.007, T1588.002, T1598, T1566.002, T1566.001, T1078.004, T1528, T1539, T1621