Threat reportPhishingTL-2026-0888
EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365
EvilTokens Phishing-as-a-Service (TL-2026-0888), also tracked as EvilTokens, is a high-severity phishing campaign, first published 2026-06-20 and last reviewed 2026-10-10. It is attributed to EvilTokens PhaaS operator with high confidence, affects Microsoft Microsoft 365 / Entra ID (OAuth 2.0 Device Authorization, maps to 56 MITRE ATT&CK techniques (T1020, T1027, T1069), and is covered by 9 detection rules and 105 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 56MITRE ATT&CK
- Actors
- 1EvilTokens PhaaS operator
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 105Indicators of compromise
Key facts for TL-2026-0888
- Threat ID
- TL-2026-0888
- Also known as
- EvilTokens, Device Code Phishing, OAuth Device Authorization Grant Phishing
- Severity
- HIGH
- Status
- DISRUPTED
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- EvilTokens PhaaS operator
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- finance, human resources, logistics, sales, construction, nonprofit, real estate, manufacturing, healthcare, legal, local government, investment
- Target regions
- North America, South America, Central America, Europe, Middle East, Asia, Oceania
- Detection rules
- 9
- Indicators of compromise
- 105
- Updates
- 2026-10-10 · 6 updates · revalidated 6× · latest source
Malware and tooling in EvilTokens Phishing-as-a-Service
Malware and tooling: EvilTokens, EvilTokens
How EvilTokens Phishing-as-a-Service works
EvilTokens is a Phishing-as-a-Service (PhaaS) kit that abuses Microsoft's legitimate OAuth 2.0 device authorization grant (RFC 8628) flow to hijack Microsoft 365 sessions without stealing passwords. Victims authenticate and complete MFA on the genuine microsoft.com/devicelogin portal but unknowingly authorize the attacker's device code, handing over valid access and refresh tokens. Launched in February 2026, the kit powered a campaign that compromised 340+ organizations across multiple countries within weeks.
EvilTokens commoditizes the device-code phishing technique pioneered in mid-2024 by the Russia-aligned actor Microsoft tracks as Storm-2372 and sells it as a turnkey Phishing-as-a-Service platform administered through a Telegram bot (operator handle 'eviltokensadmin'). The kit consists of three components: phishing pages (self-hosted or deployed on Cloudflare Workers/Pages) impersonating Microsoft, DocuSign, Adobe Acrobat Sign, OneDrive and SharePoint; a JavaScript/Node.js backend that drives the OAuth device-code flow and post-exploitation token operations; and a Telegram administration/affiliate interface that delivers harvested victim email, IP geolocation and tokens to operators.
The attack abuses RFC 8628 device authorization grant. The backend issues a POST to Microsoft's /oauth2/v2.0/devicecode endpoint using a legitimate Microsoft first-party client ID and receives a device_code, user_code and verification_uri; the user_code is valid for ~15 minutes. The victim, lured by an invoice, shared document, calendar invite, voicemail, eFax, quarantine alert, password-expiry warning or SharePoint access request, is directed to the genuine https://microsoft.com/devicelogin page and socially engineered into entering the attacker's user_code and completing authentication including MFA. The phishing page meanwhile POSTs to the kit's /api/device/start endpoint and polls /api/device/status/<sessionId> on a roughly four-second loop (guarded by a custom X-Antibot-Token header — a SHA256 of a secret, Unix timestamp and '_antibot_', validated within a 5-minute window) while the backend polls Microsoft's /common/oauth2/token endpoint. Once the victim consents, Microsoft issues an access_token (~60-90 minutes) and a refresh_token (90-day rolling) bound to the attacker's session.
Crucially, this does not bypass MFA in a technical sense — the victim completes MFA authentically on the attacker's behalf — so MFA provides no protection. When the Microsoft Authentication Broker client ID is used, the refresh token can be exchanged for a token to the device-registration service, allowing the attacker to register an attacker-controlled device in Entra ID and obtain a Primary Refresh Token (PRT). With a PRT the attacker silently authenticates to Microsoft 365 apps, bypassing credential prompts and MFA, and the kit can mint an x-ms-RefreshTokenCredential cookie for one-click browser SSO hijacking. Post-compromise, EvilTokens automates Microsoft Graph reconnaissance (/me, /organization, /users, /groups, /applications, /domains, /directoryRoles) and Azure enumeration, then enables mailbox access, file exfiltration from OneDrive/SharePoint, contact harvesting and AI-augmented business email compromise (BEC). Because refresh tokens survive password resets, remediation requires an explicit revokeSignInSessions call and removal of any rogue device registrations — a password reset alone leaves attacker access intact.
The primary technical control is a Microsoft Entra ID Conditional Access policy that blocks the device code flow (Authentication Flows condition → Device Code Flow → Grant: Block) wherever it is not operationally required.
MITRE ATT&CK techniques used in TL-2026-0888
Exfiltration
T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Defense Evasion
T1027 Obfuscated Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1564.008 Hide Artifacts: Email Hiding Rules; T1656 Impersonation; T1684.001 Impersonation
Discovery
T1069 Permission Groups Discovery; T1087 Account Discovery; T1087.004 Cloud Account; T1526 Cloud Service Discovery
Initial Access
T1078.004 Valid Accounts: Cloud Accounts; T1204.002 User Execution: Malicious File; T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link; T1566.003 Phishing: Spearphishing via Service
Command and Control
T1090 Proxy; T1090.002 Proxy: External Proxy; T1102 Web Service
Persistence
T1098.001 Account Manipulation: Additional Cloud Credentials; T1098.005 Account Manipulation: Device Registration; T1137 Office Application Startup; T1137.005 Office Application Startup: Outlook Rules; T1546 Event Triggered Execution; T1556 Modify Authentication Process
Credential Access
T1110 Brute Force; T1187 Forced Authentication; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1606 Forge Web Credentials; T1621 Multi-Factor Authentication Request Generation
Collection
T1114.002 Email Collection: Remote Email Collection; T1114.003 Email Collection: Email Forwarding Rule; T1213.002 Data from Information Repositories: Sharepoint; T1530 Data from Cloud Storage
Execution
T1204.001 User Execution: Malicious Link
Impact
T1531 Account Access Removal; T1657 Financial Theft
Lateral Movement
lateral-movement
T1550.001 Use Alternate Authentication Material: Application Access Token; T1550.004 Use Alternate Authentication Material: Web Session Cookie
Resource Development
T1583 Acquire Infrastructure; T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services; T1583.007 Acquire Infrastructure: Serverless; T1584.001 Compromise Infrastructure: Domains; T1584.006 Compromise Infrastructure: Web Services; T1585.001 Establish Accounts: Social Media Accounts; T1588.002 Obtain Capabilities: Tool
Reconnaissance
T1589.001 Gather Victim Identity Information: Credentials; T1589.002 Gather Victim Identity Information: Email Addresses; T1591 Gather Victim Org Information; T1598 Phishing for Information; T1598.003 Phishing for Information: Spearphishing Link
Affected products and versions in EvilTokens Phishing-as-a-Service
- Microsoft — Microsoft 365 / Entra ID (OAuth 2.0 Device Authorization Grant)
Vulnerable versions: Tenants with device code flow enabled (default)
Fixed in: Mitigated via Conditional Access blocking device code flow - Microsoft — Exchange Online / Outlook, Teams, SharePoint, OneDrive, Microsoft Graph
Vulnerable versions: All (accessed via stolen tokens)
Remediation for EvilTokens Phishing-as-a-Service
Immediate actions
- Deploy an Entra ID Conditional Access policy that blocks the device code flow (Authentication Flows condition → Device Code Flow → Grant: Block) wherever it is not required
- Hunt Entra ID sign-in logs for authenticationProtocol=deviceCode and originalTransferMethod=deviceCodeFlow over the last 90 days
- Block the EvilTokens Railway.com IPs (162.220.234.41, 162.220.234.66, 162.220.232.57, 162.220.232.99, 162.220.232.235) via Named Locations / perimeter
- For confirmed compromises, call revokeSignInSessions for the user (password reset alone does NOT revoke refresh tokens)
Workarounds
- Block device code flow per-app where unused
- Restrict OAuth app consent to admin-approved applications
- Network-block identified EvilTokens infrastructure and the *-s-account.workers.dev pattern at proxy/CASB
Longer-term hardening
- Audit all legitimate device code flow dependencies before enforcing an org-wide block
- Require device compliance or Hybrid Azure AD Join in Conditional Access
- Enforce admin consent for OAuth application authorizations
- Monitor for new device registrations in Entra ID and alert on registrations within 48 hours of suspicious sign-ins
- Deploy phishing-resistant (FIDO2 / passkey) authentication
Weaknesses (CWE) in EvilTokens Phishing-as-a-Service
Timeline of EvilTokens Phishing-as-a-Service
Showing the 20 most recent tracked events.
- Over 1,000 domains and ~500 Cloudflare Workers pages hosting EvilTokens phishing kits confirmed via API-endpoint and URL scanning.
- Cloud Security Alliance and Sekoia (FLINT private report) publish research notes documenting the 340+ org campaign, infrastructure and IOCs.
- Sekoia publishes public blog post on the EvilTokens kit (device code phishing-as-a-service, Part 1).
- Microsoft documents an AI-enabled EvilTokens variant using dynamic device-code generation and AI-augmented BEC capabilities.
- Microsoft Security Blog details EvilTokens' dynamic, deferred device-code generation technique — generating the code only at the final hop of a multi-platform redirect chain (Cloudflare Workers, Vercel, AWS Lambda, Railway.com) so the 15-minute expiry window starts only once the victim clicks through, defeating the flow's built-in conversion killer.
- Tycoon 2FA operators begin integrating OAuth device-code phishing into their established AiTM delivery chain, using Cloudflare Workers reputation-laundering redirectors.
- Huntress publishes analysis of EvilTokens' integrated AI chatbot capabilities for inbox mining, financial-approver/target identification, and fraud-message drafting in the victim's own voice.
- Netlas publishes threat-hunting analysis of device code phishing documenting a new SharePoint/OneDrive/DocuSign-themed backend cluster using SSE /auth/stream token-status endpoints.
- ESET WeLiveSecurity publishes consumer/enterprise advisory 'EvilTokens: the phishing that doesn't steal your password'.
- Push Security reports a 37.5x year-over-year increase in detected device-code phishing pages and catalogs 14+ distinct device-code phishing kits.
- Coinbase traces roughly $1.1 million in cryptocurrency revenue, from over 1,000 deposits across 700+ distinct addresses, paid by EvilTokens subscribers through this point.
- Trend Micro publishes 'Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass,' detailing the Microsoft Authentication Broker escalation path, following a June-July 2026 DEBULL PhaaS campaign against Microsoft 365/Entra accounts.
- Cyber Security News reports a fresh wave of device-code phishing targeting legal/business professionals via law-firm-partner impersonation, Google Sites lure pages, and open-redirector chains, with hidden mailbox-rule creation and lateral phishing observed post-compromise.
- Microsoft reassesses Storm-2372 — the nation-state cluster that originated the device-code phishing technique EvilTokens commoditizes — as an initial-access operations sub-cluster of Midnight Blizzard (APT29).
- Metropolitan Police Service receives intelligence on suspected EvilTokens operators (August 2026, per Microsoft).
- The 'GhostCode' device-code phishing kit observed registering three rogue Entra devices and obtaining a Primary Refresh Token within 78 seconds of a victim completing MFA approval.
- US District Court for the Eastern District of Virginia authorizes Microsoft's Digital Crimes Unit and co-plaintiff Health-ISAC to seize domains and infrastructure tied to EvilTokens.
- Microsoft, with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, Shadowserver, and TRM Labs, seizes 50 EvilTokens websites and disables 150+ supporting domains; UK Metropolitan Police simultaneously arrests two alleged administrators, Felix Utomi (38) and Waidi Segun Adams (32), in Canary Wharf and Nine Elms, London, releasing both on bail.
- Microsoft's analysis quantifies impact at 12,000+ inboxes across 10,000+ organizations; SpyCloud recaptured 8,708 unique accounts across 6,585 corporate domains in 79 countries.
- Microsoft DCU publicly discloses the disruption as its 40th court-authorized action and first against an end-to-end AI-enabled cybercrime service; The Register, BleepingComputer, and CyberScoop report the arrests and takedown.
Update history for TL-2026-0888
- 2026-10-10 — EvilTokens (Storm-2992) Device Code Phishing-as-a-Service Platform: What changed No field escalation. Severity HIGH and exploitability ACTIVE are unchanged. The newer report lists status MONITORING, which is not an escalation from DISRUPTED, so it was not applied. It also lists attribution confidence MEDIUM
- 2026-09-27 — EvilTokens Phishing-as-a-Service Disrupted: UK Arrests 2, Microsoft Seizes 50 Sites (Device-Code MFA Bypass): What changed Status ACTIVE → DISRUPTED: Microsoft's DCU, under a 2026-09-15 US EDVA court order, seized 50 EvilTokens sites and disabled 150+ supporting domains; UK Metropolitan Police arrested two alleged administrators on 2026-09-18. Attr
- 2026-09-18 — Device Code Phishing: OAuth 2.0 Device Authorization Grant Abused to Bypass MFA on Microsoft 365 / Entra ID: What changed No severity/exploitability/status change. The GhostCode kit adds a faster (~78s) device-registration-to-PRT chain to the family of device-code phishing kits already tracked under this threat. New indicators (2) 1 new tool ident
- 2026-09-13 — Device Code Phishing: OAuth Device Authorization Grant Abuse via Commoditized EvilTokens PhaaS Kit: What changed No severity/exploitability/status escalation — both remain HIGH/ACTIVE/ACTIVE. The material change is attributional and infrastructural: Microsoft reassessed Storm-2372 (the nation-state actor that originated this technique) as
- 2026-07-26 — Device Code Phishing: OAuth Device Authorization Grant Abused to Bypass MFA and Hijack Microsoft Entra Sessions: What changed No escalation to core fields (severity HIGH, exploitability ACTIVE, status ACTIVE, attribution MEDIUM all hold). The threat's technique/ecosystem context broadens materially: device-code phishing has spread beyond EvilTokens to
- 2026-07-23 — Device-Code OAuth Phishing Steals Microsoft 365 Sessions Post-MFA (Storm-2372 / EvilTokens PhaaS Tradecraft): What changed Impact raised HIGH → CRITICAL on evidence of a July 2026 campaign wave adding durable post-compromise persistence (hidden Inbox-rule creation via New-InboxRule to suppress bounce-backs/replies) and confirmed self-propagating la
Sources cited for EvilTokens Phishing-as-a-Service
- EvilTokens: the phishing that doesn't steal your password
- New widespread EvilTokens kit: device code phishing as-a-service - Part 1
- CSA Research Note: OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations
- Hackers Abuse Microsoft OAuth Device Code Flow to Take Over Microsoft 365 Accounts
- New phishing campaign tricks employees into bypassing Microsoft 365 MFA (CSO Online)
- Storm-2372 conducts device code phishing campaign (Microsoft Security Blog)
- OAuth Device Code Phishing Campaigns Surge Targets Microsoft 365 (Infosecurity Magazine)
- Microsoft 365 Device-Code Phishing: Detection & Blocking (Hard2bit)
Detection coverage for TL-2026-0888
As of 2026-10-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0888 across Splunk SPL, Microsoft KQL and Sigma, covering 105 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.