EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code" to Breach Finance, Tech, and Managed Security Firms
EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device (TL-2026-1201), also tracked as Ghost Code phishing, is a high-severity phishing campaign, first published 2026-07-11. It is attributed to EvilTokens with medium confidence, affects Microsoft Microsoft 365 / Entra ID OAuth 2.0 Device Authorization, maps to 20 MITRE ATT&CK techniques (T1027, T1036.005, T1041), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-1201
- Threat ID
- TL-2026-1201
- Also known as
- Ghost Code phishing, OAuth device-code phishing (EvilTokens variant)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-07-11
- Last reviewed
- 2026-07-11
- Attribution
- EvilTokens
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- financial services, banking, consulting, technology, manufacturing, education, managed security services, health, government administration, construction, real estate, legal
- Target regions
- united states of america, canada, Europe, france, switzerland, germany, united kingdom, australia, new zealand, india, united arab emirates
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device
Malware and tooling: EvilTokens, Tycoon 2FA
EvilTokens is a commercial Phishing-as-a-Service (PhaaS) platform, active since mid-February 2026, that abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant flow to hijack Microsoft 365 access and refresh tokens without ever presenting a fake login page. Its landing pages ship as an encrypted (AES-GCM, Web Crypto API) blob that only decrypts and renders in the DOM client-side, evading static URL scanners and network-level content inspection. The kit has compromised 340+ Microsoft 365 organizations across financial services, technology, manufacturing, education, healthcare, government, construction, and managed-security-services sectors in the U.S., Canada, and Europe.
How EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device works
EvilTokens is a turnkey device-code phishing kit sold under a Phishing-as-a-Service model via a Telegram bot administered by the handle 'eviltokensadmin', priced around $1,500 one-time plus $500/month for the core Office 365 kit, with additional paid modules for B2B/SMTP delivery ($600-$1,000) and a multi-account portal ($500 lifetime). The kit weaponizes Microsoft's OAuth 2.0 Device Authorization Grant (device-code) flow: phishing lures impersonating Adobe Acrobat, DocuSign, voicemail notifications, fax alerts, quarantine notices, calendar invites, and SharePoint shares direct victims to enter an attacker-generated device code at the genuine microsoft.com/devicelogin portal. Because the victim interacts only with authentic Microsoft infrastructure and completes their own MFA challenge, the attack does not defeat MFA -- it redirects the resulting OAuth tokens to the attacker's polling client instead of the victim's device. Landing pages are served as an empty <div id="r"> container plus an async script that fetches a base64-encoded, AES-GCM-encrypted blob via crypto.subtle (Web Crypto API) and decrypts/injects it into the DOM only in the victim's browser -- so static URL analysis and network-level inspection see only ciphertext, never the rendered phishing content ('Ghost Code'). A custom X-Antibot-Token header (SHA-256 of a secret plus Unix timestamp plus the string '_antibot', valid for 5 minutes) gates automated crawlers and sandboxes away from the real payload, and a gate-check endpoint can serve decoy pages when scanning is detected. Backend API endpoints implement the full device-code lifecycle plus post-compromise tooling: /api/device/gate/<PAGE_ID> (campaign liveness check), /api/device/start (initiates device code + polls), /api/device/status/:sessionId, /oauth2/v2.0/devicecode and /oauth2/v2.0/token (proxied against real Microsoft endpoints), /api/prt/convert (refresh-token-to-PRT conversion), /api/prt/cookie (SSO/OWA session cookie generation), /api/prt/recon and /api/prt/azure (Graph API and Azure AD reconnaissance/enumeration). Harvested refresh tokens carry a roughly 90-day rolling validity window and survive password resets, meaning organizations that reset credentials without calling revokeSignInSessions and revoking outstanding tokens have not remediated the compromise. The platform advertises built-in LLM/AI automation that ingests up to 5,000 harvested emails per victim mailbox to identify exploitable payment threads and auto-generate contextually appropriate BEC follow-on messages. Infrastructure is hosted primarily on Cloudflare Workers (subdomains following the pattern [template]-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev) with over 30 documented self-hosted affiliate domains, and campaign polling/session infrastructure has also been observed on Railway.com's PaaS. EvilTokens follows in the footsteps of the Russia-aligned actor Storm-2372, which Microsoft assesses conducted state-aligned device-code phishing against government, NGO, defense, telecom, healthcare, and energy targets from August 2024 through February 2025; EvilTokens commoditized and scaled the same TTP for the broader cybercrime market beginning February 2026, and by late March 2026 more than 1,000 phishing domains and 340+ compromised Microsoft 365 organizations had been identified. A parallel device-code adoption wave was also observed among Tycoon 2FA AitM operators following the March 2026 seizure of Tycoon 2FA infrastructure, driving a reported 37.5-fold increase in device-code phishing page volume by April 2026. The kit publicly announced plans to extend support to Gmail and Okta device/authorization-code flows.
MITRE ATT&CK techniques used in TL-2026-1201
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel
Command and Control
Initial Access
T1078.004 Cloud Accounts; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Discovery
Persistence
Collection
T1114 Email Collection; T1213 Data from Information Repositories
collection
T1114.003 Email Forwarding Rule
Credential Access
T1187 Forced Authentication; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie
Execution
lateral-movement
T1550.001 Application Access Token
Lateral Movement
T1550.001 Application Access Token
Resource Development
Reconnaissance
Affected products and versions in EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device
- Microsoft — Microsoft 365 / Entra ID OAuth 2.0 Device Authorization Grant flow
Vulnerable versions: all tenants with Device Code Flow enabled and unrestricted
Fixed in: tenants with Conditional Access blocking Device Code Flow - Microsoft — SharePoint Online / OneDrive / Outlook Web Access
Vulnerable versions: accessible via any successfully hijacked OAuth session
Remediation for EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device
Immediate actions
- Query Entra ID sign-in logs for authentication events showing Device Code Flow as the client authentication type and treat any unexpected hits as compromise
- For any account with a device-code sign-in, call the revokeSignInSessions Graph/PowerShell API and explicitly revoke outstanding refresh tokens -- a password reset alone does not remediate a stolen refresh token
- Review inbox rule modifications, external email forwarding configuration, and SharePoint/OneDrive access events in the days following any identified device-code authentication for BEC follow-on activity
- Hunt for anomalous Outlook Web Access sessions and Microsoft Graph API access from unfamiliar IP ranges or ASNs tied to Cloudflare Workers or Railway.com
Workarounds
- Create a Conditional Access policy blocking the Device Code Flow authentication condition for all users and cloud applications that have no documented operational need for it
- For any legitimate device-code use cases (e.g., headless/IoT sign-in), restrict polling to documented corporate IP ranges or VPN egress addresses via Conditional Access location controls
Longer-term hardening
- Implement phishing-resistant authentication (FIDO2 security keys, Windows Hello for Business, passkeys) for all users, with mandatory enforcement for privileged and high-value accounts
- Deploy security awareness training specifically covering device-code phishing lures (fake Adobe/DocuSign/voicemail/fax/quarantine notifications directing to microsoft.com/devicelogin)
- Establish routine token rotation and revocation procedures and centralize OAuth app/token inventory review
Weaknesses (CWE) in EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device
CWE-294, CWE-287, CWE-451
Timeline of EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device
- Russia-aligned actor Storm-2372 begins state-aligned Microsoft device-code phishing campaigns against government, NGO, defense, telecom, healthcare, and energy targets across Europe, North America, Africa, and the Middle East (through February 2025).
- Microsoft and Volexity first publicly document device-code phishing as an active abuse technique against Microsoft 365 tenants.
- EvilTokens Phishing-as-a-Service platform launches; device-code phishing pages using the kit begin appearing in the wild.
- Security vendors begin detecting the EvilTokens-driven device-code phishing wave targeting Microsoft 365 organizations.
- Sekoia creates the first YARA detection rule for EvilTokens phishing infrastructure.
- EvilTokens' private Telegram distribution channel reaches approximately 280 subscribers.
- More than 1,000 EvilTokens phishing domains identified across Cloudflare Workers and self-hosted affiliate infrastructure.
- Huntress/FLINT private threat intelligence report on the campaign distributed; The Hacker News reports the campaign has hit 340+ Microsoft 365 organizations across five countries.
- Sekoia publishes a detailed public technical analysis of the EvilTokens kit, infrastructure, and backend API.
- Tycoon 2FA AitM phishing operators adopt device-code phishing following the March 2026 seizure of Tycoon 2FA infrastructure, driving a reported 37.5-fold increase in device-code phishing page volume.
- Cloud Security Alliance publishes a research note on EvilTokens device-code phishing, detailing PRT-hijack API endpoints, pricing, and detection guidance.
- Cyber Security News reports on the AES-GCM 'Ghost Code' DOM-decryption evasion technique and continued targeting of finance, technology, and managed-security firms across the U.S. and Europe.
- The Hacker News and Security Boulevard report a broader 'Ghost Phishing' wave using the same client-side encrypted-DOM evasion pattern, indicating adoption beyond the original EvilTokens kit.
Sources cited for EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device
- EvilTokens Phishing Breaches Finance Firms Using Ghost Code Across U.S. and European Businesses
- New Ghost Phishing Wave Is Breaking Traditional Email Security
- New widespread EvilTokens kit: device code phishing as-a-service, part 1
- EvilTokens: Device-Code Phishing Renders MFA Irrelevant (CSA Research Note)
- Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse
- EvilTokens "Ghost" Code Phishing Analysis
- EvilTokens: How "Ghost" Code Threatens US and European Businesses
- Ghost Phishing Campaign Exploits Browser Blind Spot to Target Microsoft 365 Accounts
Threats related to EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device
- ARToken: Business Email Compromise-as-a-Service Platform Targeting Microsoft 365 (Cisco Talos / EvilTokens Affiliate)
- ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens PhaaS)
- EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365
- Top Phishing-Kit Platforms Driving AiTM Session-Theft and MFA-Bypass Campaigns (SOCRadar, Aug 2026)
- Device Code Phishing Surge — 37x Increase Driven by EvilTokens and VENOM PhaaS Kits Targeting Microsoft 365
- Advanced Phishing Tradecraft: ClickFix, Browser-in-the-Browser, OAuth Consent, Device Code, and Fake Video-Conference Lures Bypass MFA and Security Awareness Training
Detection coverage for TL-2026-1201
As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1201 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.