# EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365

> EvilTokens is a Phishing-as-a-Service (PhaaS) kit that abuses Microsoft's legitimate OAuth 2.0 device authorization grant (RFC 8628) flow to hijack Microsoft 365 sessions without stealing passwords. Victims authenticate and complete MFA on the genuine microsoft.com/devicelogin portal but unknowingly authorize the attacker's device code, handing over valid access and refresh tokens. Launched in February 2026, the kit powered a campaign that compromised 340+ organizations across multiple countries within weeks.

- **Published:** 2026-06-20T00:00:00Z
- **Last reviewed:** 2026-10-10T02:56:57.391Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0888
- **ID:** TL-2026-0888
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** DISRUPTED
- **Actor:** EvilTokens PhaaS operator
- **Detections:** 9 · **IOCs:** 105 (full data via the Threadlinqs MCP server — Purple tier)

## Description

EvilTokens commoditizes the device-code phishing technique pioneered in mid-2024 by the Russia-aligned actor Microsoft tracks as Storm-2372 and sells it as a turnkey Phishing-as-a-Service platform administered through a Telegram bot (operator handle 'eviltokensadmin'). The kit consists of three components: phishing pages (self-hosted or deployed on Cloudflare Workers/Pages) impersonating Microsoft, DocuSign, Adobe Acrobat Sign, OneDrive and SharePoint; a JavaScript/Node.js backend that drives the OAuth device-code flow and post-exploitation token operations; and a Telegram administration/affiliate interface that delivers harvested victim email, IP geolocation and tokens to operators.

The attack abuses RFC 8628 device authorization grant. The backend issues a POST to Microsoft's /oauth2/v2.0/devicecode endpoint using a legitimate Microsoft first-party client ID and receives a device_code, user_code and verification_uri; the user_code is valid for ~15 minutes. The victim, lured by an invoice, shared document, calendar invite, voicemail, eFax, quarantine alert, password-expiry warning or SharePoint access request, is directed to the genuine https://microsoft.com/devicelogin page and socially engineered into entering the attacker's user_code and completing authentication including MFA. The phishing page meanwhile POSTs to the kit's /api/device/start endpoint and polls /api/device/status/<sessionId> on a roughly four-second loop (guarded by a custom X-Antibot-Token header — a SHA256 of a secret, Unix timestamp and '_antibot_', validated within a 5-minute window) while the backend polls Microsoft's /common/oauth2/token endpoint. Once the victim consents, Microsoft issues an access_token (~60-90 minutes) and a refresh_token (90-day rolling) bound to the attacker's session.

Crucially, this does not bypass MFA in a technical sense — the victim completes MFA authentically on the attacker's behalf — so MFA provides no protection. When the Microsoft Authentication Broker client ID is used, the refresh token can be exchanged for a token to the device-registration service, allowing the attacker to register an attacker-controlled device in Entra ID and obtain a Primary Refresh Token (PRT). With a PRT the attacker silently authenticates to Microsoft 365 apps, bypassing credential prompts and MFA, and the kit can mint an x-ms-RefreshTokenCredential cookie for one-click browser SSO hijacking. Post-compromise, EvilTokens automates Microsoft Graph reconnaissance (/me, /organization, /users, /groups, /applications, /domains, /directoryRoles) and Azure enumeration, then enables mailbox access, file exfiltration from OneDrive/SharePoint, contact harvesting and AI-augmented business email compromise (BEC). Because refresh tokens survive password resets, remediation requires an explicit revokeSignInSessions call and removal of any rogue device registrations — a password reset alone leaves attacker access intact.

The primary technical control is a Microsoft Entra ID Conditional Access policy that blocks the device code flow (Authentication Flows condition → Device Code Flow → Grant: Block) wherever it is not operationally required.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.007 Acquire Infrastructure: Serverless
- T1588.002 Obtain Capabilities: Tool
- T1598 Phishing for Information
- T1566.002 Phishing: Spearphishing Link
- T1566.001 Phishing: Spearphishing Attachment
- T1078.004 Valid Accounts: Cloud Accounts
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1621 Multi-Factor Authentication Request Generation
- T1606 Forge Web Credentials
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1684.001 Impersonation
- T1098.005 Account Manipulation: Device Registration
- T1556 Modify Authentication Process
- T1526 Cloud Service Discovery
- T1087.004 Cloud Account
- T1114.002 Email Collection: Remote Email Collection
- T1530 Data from Cloud Storage
- T1567 Exfiltration Over Web Service
- T1566 Phishing
- T1187 Forced Authentication
- T1110 Brute Force
- T1137 Office Application Startup
- T1546 Event Triggered Execution
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1102 Web Service
- T1090 Proxy
- T1534 Internal Spearphishing
- T1531 Account Access Removal
- T1589.002 Gather Victim Identity Information: Email Addresses
- T1598.003 Phishing for Information: Spearphishing Link
- T1583.001 Acquire Infrastructure: Domains
- T1584.006 Compromise Infrastructure: Web Services
- T1585.001 Establish Accounts: Social Media Accounts
- T1098.001 Account Manipulation: Additional Cloud Credentials
- T1027 Obfuscated Files or Information
- T1497.001 Virtualization/Sandbox Evasion: System Checks

## Sources

- [EvilTokens: the phishing that doesn't steal your password](https://www.welivesecurity.com/en/cybercrime/eviltokens-phishing-doesnt-steal-password/)
- [New widespread EvilTokens kit: device code phishing as-a-service - Part 1](https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/)
- [CSA Research Note: OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-m365-20260325-c/)
- [Hackers Abuse Microsoft OAuth Device Code Flow to Take Over Microsoft 365 Accounts](https://gbhackers.com/microsoft-oauth-device-code-abused/)
- [New phishing campaign tricks employees into bypassing Microsoft 365 MFA (CSO Online)](https://www.csoonline.com/article/4134874/new-phishing-campaign-tricks-employees-into-bypassing-microsoft-365-mfa.html)
- [Storm-2372 conducts device code phishing campaign (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [OAuth Device Code Phishing Campaigns Surge Targets Microsoft 365 (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/oauth-phishing-campaigns/)
- [Microsoft 365 Device-Code Phishing: Detection & Blocking (Hard2bit)](https://hard2bit.com/en/blog/microsoft-365-device-code-phishing-prevention-detection/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0888