# EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code" to Breach Finance, Tech, and Managed Security Firms

> EvilTokens is a commercial Phishing-as-a-Service (PhaaS) platform, active since mid-February 2026, that abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant flow to hijack Microsoft 365 access and refresh tokens without ever presenting a fake login page. Its landing pages ship as an encrypted (AES-GCM, Web Crypto API) blob that only decrypts and renders in the DOM client-side, evading static URL scanners and network-level content inspection. The kit has compromised 340+ Microsoft 365 organizations across financial services, technology, manufacturing, education, healthcare, government, construction, and managed-security-services sectors in the U.S., Canada, and Europe.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1201
- **ID:** TL-2026-1201
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** EvilTokens
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

EvilTokens is a turnkey device-code phishing kit sold under a Phishing-as-a-Service model via a Telegram bot administered by the handle 'eviltokensadmin', priced around $1,500 one-time plus $500/month for the core Office 365 kit, with additional paid modules for B2B/SMTP delivery ($600-$1,000) and a multi-account portal ($500 lifetime). The kit weaponizes Microsoft's OAuth 2.0 Device Authorization Grant (device-code) flow: phishing lures impersonating Adobe Acrobat, DocuSign, voicemail notifications, fax alerts, quarantine notices, calendar invites, and SharePoint shares direct victims to enter an attacker-generated device code at the genuine microsoft.com/devicelogin portal. Because the victim interacts only with authentic Microsoft infrastructure and completes their own MFA challenge, the attack does not defeat MFA -- it redirects the resulting OAuth tokens to the attacker's polling client instead of the victim's device. Landing pages are served as an empty <div id="r"> container plus an async script that fetches a base64-encoded, AES-GCM-encrypted blob via crypto.subtle (Web Crypto API) and decrypts/injects it into the DOM only in the victim's browser -- so static URL analysis and network-level inspection see only ciphertext, never the rendered phishing content ('Ghost Code'). A custom X-Antibot-Token header (SHA-256 of a secret plus Unix timestamp plus the string '_antibot', valid for 5 minutes) gates automated crawlers and sandboxes away from the real payload, and a gate-check endpoint can serve decoy pages when scanning is detected. Backend API endpoints implement the full device-code lifecycle plus post-compromise tooling: /api/device/gate/<PAGE_ID> (campaign liveness check), /api/device/start (initiates device code + polls), /api/device/status/:sessionId, /oauth2/v2.0/devicecode and /oauth2/v2.0/token (proxied against real Microsoft endpoints), /api/prt/convert (refresh-token-to-PRT conversion), /api/prt/cookie (SSO/OWA session cookie generation), /api/prt/recon and /api/prt/azure (Graph API and Azure AD reconnaissance/enumeration). Harvested refresh tokens carry a roughly 90-day rolling validity window and survive password resets, meaning organizations that reset credentials without calling revokeSignInSessions and revoking outstanding tokens have not remediated the compromise. The platform advertises built-in LLM/AI automation that ingests up to 5,000 harvested emails per victim mailbox to identify exploitable payment threads and auto-generate contextually appropriate BEC follow-on messages. Infrastructure is hosted primarily on Cloudflare Workers (subdomains following the pattern [template]-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev) with over 30 documented self-hosted affiliate domains, and campaign polling/session infrastructure has also been observed on Railway.com's PaaS. EvilTokens follows in the footsteps of the Russia-aligned actor Storm-2372, which Microsoft assesses conducted state-aligned device-code phishing against government, NGO, defense, telecom, healthcare, and energy targets from August 2024 through February 2025; EvilTokens commoditized and scaled the same TTP for the broader cybercrime market beginning February 2026, and by late March 2026 more than 1,000 phishing domains and 340+ compromised Microsoft 365 organizations had been identified. A parallel device-code adoption wave was also observed among Tycoon 2FA AitM operators following the March 2026 seizure of Tycoon 2FA infrastructure, driving a reported 37.5-fold increase in device-code phishing page volume by April 2026. The kit publicly announced plans to extend support to Gmail and Okta device/authorization-code flows.

## MITRE ATT&CK

- T1583.006 Web Services
- T1598.003 Spearphishing Link
- T1566.002 Spearphishing Link
- T1566.001 Spearphishing Attachment
- T1078.004 Cloud Accounts
- T1204.001 Malicious Link
- T1098 Account Manipulation
- T1114.003 Email Forwarding Rule
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1550.001 Application Access Token
- T1187 Forced Authentication
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1087.004 Cloud Account
- T1550.001 Application Access Token
- T1114 Email Collection
- T1213 Data from Information Repositories
- T1071.001 Web Protocols
- T1041 Exfiltration Over C2 Channel

## Sources

- [EvilTokens Phishing Breaches Finance Firms Using Ghost Code Across U.S. and European Businesses](https://cybersecuritynews.com/eviltokens-phishing-breaches-finance-firms-using-ghost-code-across-u-s-and-european-businesses/)
- [New Ghost Phishing Wave Is Breaking Traditional Email Security](https://thehackernews.com/2026/07/new-ghost-phishing-wave-is-breaking.html)
- [New widespread EvilTokens kit: device code phishing as-a-service, part 1](https://www.sekoia.com/blog/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1)
- [EvilTokens: Device-Code Phishing Renders MFA Irrelevant (CSA Research Note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-eviltokens-2026/)
- [Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse](https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html)
- [EvilTokens "Ghost" Code Phishing Analysis](https://any.run/cybersecurity-blog/eviltokens-ghost-code-analysis/)
- [EvilTokens: How "Ghost" Code Threatens US and European Businesses](https://hackernoon.com/eviltokens-how-ghost-code-threatens-us-and-european-businesses)
- [Ghost Phishing Campaign Exploits Browser Blind Spot to Target Microsoft 365 Accounts](https://securityboulevard.com/2026/07/ghost-phishing-campaign-exploits-browser-blind-spot-to-target-microsoft-365-accounts/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1201