EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code" to Breach Finance, Tech, and Managed Security Firms — Threadlinqs Intelligence
As of 2026-07-11, EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code" to Breach Finance, Tech, and Managed Security Firms is a high-severity phishing threat attributed to EvilTokens, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-1201 · Severity: HIGH · Status: ACTIVE · Category: PHISHING
Attribution: EvilTokens · FINANCIAL
EvilTokens is a commercial Phishing-as-a-Service (PhaaS) platform, active since mid-February 2026, that abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant flow to hijack Microsoft 365
EvilTokens is a turnkey device-code phishing kit sold under a Phishing-as-a-Service model via a Telegram bot administered by the handle 'eviltokensadmin', priced around $1,500 one-time plus $500/month for the core Office 365 kit, with additional paid modules for B2B/SMTP delivery ($600-$1,000) and a multi-account portal ($500 lifetime). The kit weaponizes Microsoft's OAuth 2.0 Device Authorization Grant (device-code) flow: phishing lures impersonating Adobe Acrobat, DocuSign, voicemail notifications, fax alerts, quarantine notices, calendar invites, and SharePoint shares direct victims to enter an attacker-generated device code at the genuine microsoft.com/devicelogin portal. Because the victim interacts only with authentic Microsoft infrastructure and completes their own MFA challenge, the attack does not defeat MFA -- it redirects the resulting OAuth tokens to the attacker's polling client instead of the victim's device. Landing pages are served as an empty <div id="r"> container plus an async script that fetches a base64-encoded, AES-GCM-encrypted blob via crypto.subtle (Web Crypto API) and decrypts/injects it into the DOM only in the victim's browser -- so static URL analysis and network-level inspection see only ciphertext, never the rendered phishing content ('Ghost Code'). A custom X-Antibot-Token header (SHA-256 of a secret plus Unix timestamp plus the string '_antibot', valid for 5 minutes) gates automated crawlers and sandboxes away from the real payload, and a gate-check endpoint can serve decoy pages when scanning is detected. Backend API endpoints implement the full device-code lifecycle plus post-compromise tooling: /api/device/gate/<PAGE_ID> (campaign liveness check), /api/device/start (initiates device code + polls), /api/device/status/:sessionId, /oauth2/v2.0/devicecode and /oauth2/v2.0/token (proxied against real Microsoft endpoints), /api/prt/convert (refresh-token-to-PRT conversion), /api/prt/cookie (SSO/OWA session cookie generation), /api/prt/recon and /api/prt/azure (Graph API and Azure AD reconnaissance/enumeration). Harvested refresh tokens carry a roughly 90-day rolling validity window and survive password resets, meaning organizations that reset credentials without calling revokeSignInSessions and revoking outstanding tokens have not remediated the compromise. The platform advertises built-in LLM/AI automation that ingests up to 5,000 harvested emails per victim mailbox to identify exploitable payment threads and auto-generate contextually appropriate BEC follow-on messages. Infrastructure is hosted primarily on Cloudflare Workers (subdomains following the pattern [template]-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev) with over 30 documented self-hosted affiliate domains, and campaign polling/session infrastructure has also been observed on Railway.com's PaaS. EvilTokens follows in the footsteps of the Russia-aligned actor Storm-2372, which Microsoft assesses conducted state-aligned device-code phishing against government, NGO, defense, telecom, healthcare, and energy targets from August 2024 through February 2025; EvilTokens commoditized and scaled the same TTP for the broader cybercrime market beginning February 2026, and by late March 2026 more than 1,000 phishing domains and 340+ compromised Microsoft 365 organizations had been identified. A parallel device-code adoption wave was also observed among Tycoon 2FA AitM operators following the March 2026 seizure of Tycoon 2FA infrastructure, driving a reported 37.5-fold increase in device-code phishing page volume by April 2026. The kit publicly announced plans to extend support to Gmail and Okta device/authorization-code flows.
Weaknesses (CWE)
CWE-294, CWE-287, CWE-451
Target sectors: financial services, banking, consulting, technology, manufacturing, education, managed security services, health, government administration, construction, real estate, legal
Target regions: united states of america, canada, Europe, france, switzerland, germany, united kingdom, australia, new zealand, india, united arab emirates
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1583.006, T1598.003, T1566.002, T1566.001, T1078.004, T1204.001, T1098, T1114.003, T1027, T1140