Microsoft-Led Coalition Takes Down EvilTokens AI-Powered Phishing-as-a-Service Platform (Storm-2992)

Key facts for Storm-2992 EvilTokens PhaaS

Detection coverage for Storm-2992 EvilTokens PhaaS

As of 2026-09-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2614 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: OAuth Device Code Phishing — Device Authorization Grant Abuse (EvilTokens/Storm-2992)

Detects the EvilTokens exploitation chain: a phishing lure (Adobe Acrobat/DocuSign/SharePoint/payroll-themed PDF, DOCX, XLSX, SVG, or QR-code attachment) directs a victim to the legitimate microsoft.com/devicelogin or login.microsoftonline.com/common/oauth2/deviceauth endpoint to enter an attacker-supplied device code. Because the victim completes their own MFA on genuine Microsoft infrastructure, Microsoft issues the OAuth access/refresh tokens to the attacker's polling session (T1528) instead of the victim's, bypassing MFA without a fake login page or malware.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.001, T1566.002, T1204.001, T1528, T1187, T1591.004
• Data sources: azure_ad_signin_logs, microsoft_entra_id_signin_logs, email_security_gateway, proxy_logs
• Severity: critical
• Confidence: high

Splunk SPL

`comment("EvilTokens/Storm-2992 exploitation: device-code auth combined with phishing lure delivery")`
index=azuread sourcetype="azure:aad:signin" earliest=-24h
| eval is_device_code=if(match(authenticationProtocol,"(?i)devicecode") OR match(authenticationRequirement,"(?i)devicecode") OR match(originalTransferMethod,"(?i)deviceCodeFlow") OR match(resultDescription,"(?i)device code"),1,0)
| where is_device_code=1
| eval railway_src=if(cidrmatch("162.220.232.0/24",src_ip) OR cidrmatch("162.220.234.0/24",src_ip),1,0)
| eval saw_50199=if(match(errorCode,"50199"),1,0)
| stats count as auth_events, values(resultDescription) as results, values(errorCode) as error_codes, max(railway_src) as railway_infra_seen, max(saw_50199) as saw_50199_flag, min(_time) as first_seen, max(_time) as last_seen by user, src_ip, appDisplayName
| where railway_infra_seen=1 OR auth_events>2
| join type=left user
    [ search index=email sourcetype="ms:o365:security_events" OR sourcetype="mimecast:siem:receipt" earliest=-24h
      (subject="*Adobe*" OR subject="*DocuSign*" OR subject="*SharePoint*" OR subject="*payroll*" OR subject="*invoice*" OR subject="*security alert*")
      (attachment_extension IN ("pdf","docx","xlsx","svg","html"))
    | rename recipient as user
    | stats count as lure_email_count values(subject) as lure_subjects values(attachment_extension) as lure_attachment_types by user ]
| convert ctime(first_seen) ctime(last_seen)
| sort - auth_events

Microsoft KQL

let RailwayCIDRs = dynamic(["162.220.232.0/24","162.220.234.0/24"]);
let DeviceCodeSignins = SigninLogs
| where TimeGenerated > ago(24h)
| where AuthenticationProtocol == "deviceCode" or AuthenticationRequirement has "deviceCode" or ResultDescription has "device code"
| extend IsRailwayInfra = ipv4_is_match(IPAddress, "162.220.232.0/24") or ipv4_is_match(IPAddress, "162.220.234.0/24")
| extend Saw50199 = ResultType == "50199";
let LurePhish = EmailEvents
| where TimeGenerated > ago(24h)
| where Subject has_any ("Adobe", "DocuSign", "SharePoint", "payroll", "invoice", "security alert")
| where AttachmentCount > 0
| project RecipientEmailAddress, Subject, SenderFromDomain, TimeGenerated;
DeviceCodeSignins
| summarize AttemptCount = count(), ResultTypes = make_set(ResultType), IsRailwayInfra = max(toint(IsRailwayInfra)), Saw50199Flag = max(toint(Saw50199)), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserPrincipalName, IPAddress, AppDisplayName
| where IsRailwayInfra == 1 or AttemptCount > 2
| join kind=leftouter (LurePhish | project UserPrincipalName = RecipientEmailAddress, Subject, SenderFromDomain) on UserPrincipalName
| project UserPrincipalName, IPAddress, AppDisplayName, AttemptCount, ResultTypes, IsRailwayInfra, Saw50199Flag, FirstSeen, LastSeen, Subject, SenderFromDomain

Sigma

title: OAuth Device Code Phishing - EvilTokens/Storm-2992 Device Authorization Grant Abuse
id: 3f6a8b2e-9c4d-4e11-8a2f-1d6c9e7b5a01
status: experimental
description: Detects OAuth 2.0 Device Authorization Grant (RFC 8628) sign-ins consistent with EvilTokens/Storm-2992 device-code phishing, where a victim is lured (Adobe/DocuSign/SharePoint/payroll-themed attachment or QR code) into entering an attacker-supplied device code at the legitimate Microsoft device-login endpoint.
references:
    - https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/
    - https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/
    - https://cyberscoop.com/microsoft-eviltokens-cybercrime-service-takedown/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-22
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.t1566.002
    - attack.execution
    - attack.t1204.001
    - attack.credential-access
    - attack.t1528
    - attack.t1187
    - attack.tool.eviltokens
    - attack.group.storm-2992
logsource:
    product: azure
    service: signinlogs
detection:
    selection_devicecode:
        AuthenticationProtocol: 'deviceCode'
    selection_devicecode_alt:
        AuthenticationRequirement|contains: 'deviceCode'
    selection_railway_infra:
        IPAddress|cidr:
            - '162.220.232.0/24'
            - '162.220.234.0/24'
    condition: selection_devicecode or selection_devicecode_alt or selection_railway_infra
falsepositives:
    - Legitimate device-code flow for kiosks, Teams Rooms devices, smart TVs, printers, or CLI tools (Azure CLI, PowerShell, gh CLI) with a documented business need
    - Security awareness/phishing-simulation platforms mimicking Adobe/DocuSign/SharePoint lures for training
level: high

Known false positives:

• Legitimate device-code authentication for kiosks, Teams Rooms devices, smart TVs, printers, or CLI tools (Azure CLI, PowerShell) using the documented RFC 8628 business flow
• Security awareness/phishing-simulation platforms that mimic Adobe/DocuSign/SharePoint lures for training purposes

Tuning notes: Baseline and allowlist approved AppIds/device types that legitimately use device-code flow (e.g., specific IoT/kiosk service principals); tighten the Railway.com CIDR match into a hard Conditional Access block per remediation guidance; correlate with Entra ID Protection ErrorCode 50199 followed by a success within 5 minutes for higher-fidelity alerting.

• 🔒 OAuth Device Code Phishing — Device Authorization Grant Abuse (EvilTokens/Storm-2992) · unlock with TL Creds
• 🔒 Post-Compromise Token Abuse — Device Registration, PRT Minting & Mailbox Persistence (EvilTokens) · unlock with TL Creds
• 🔒 EvilTokens C2 Polling Infrastructure & BEC Lateral Movement / Invoice Fraud · unlock with TL Creds
• 🔒 OAuth Device Code Phishing — Device Authorization Grant Abuse (EvilTokens/Storm-2992) · unlock with TL Creds
• 🔒 Post-Compromise Token Abuse — Device Registration, PRT Minting & Mailbox Persistence (EvilTokens) · unlock with TL Creds
• 🔒 EvilTokens C2 Polling Infrastructure & BEC Lateral Movement / Invoice Fraud · unlock with TL Creds
• 🔒 Post-Compromise Token Abuse — Device Registration, PRT Minting & Mailbox Persistence (EvilTokens) · unlock with TL Creds
• 🔒 EvilTokens C2 Polling Infrastructure & BEC Lateral Movement / Invoice Fraud · unlock with TL Creds

Indicators of compromise for Storm-2992 EvilTokens PhaaS

As of 2026-09-22, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-2614.

Sample indicators (3 of 20)

• IP address: 162.220.234[.]41
• Domain: authdocspro[.]com
• IP address: 162.220.234[.]66

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

How Storm-2992 EvilTokens PhaaS works

Two operators (32 and 38) were arrested in Canary Wharf and Nine Elms, London on September 18, 2026; roughly 1,000 subscribers used the kit to compromise 12,000+ Microsoft 365 inboxes across 10,000+ organizations in 79 countries.

EvilTokens is a subscription phishing-as-a-service (PhaaS) kit, first observed mid-February 2026 and sold openly over Telegram, that weaponizes the OAuth 2.0 Device Authorization Grant — the flow Microsoft designed to let keyboardless devices (smart TVs, printers, Teams room devices) authenticate — to hijack Microsoft 365 accounts without ever touching a password or a fake login page. An operator requests a legitimate Microsoft device code and user code, then delivers it to a victim through a socially-engineered lure (fake Adobe Acrobat/DocuSign requests, invoice approvals, SharePoint notifications, payroll or security alerts, sometimes via PDF/HTML/DOCX/XLSX/SVG attachments carrying QR codes). The victim is directed to the real microsoft.com/devicelogin page, enters the code, and completes their own MFA challenge on genuine Microsoft infrastructure — at which point Microsoft issues the access and refresh tokens to the attacker's polling session instead of the victim's. The 90-day rolling refresh token survives password resets and is not revoked by MFA re-enrollment, only by an explicit revokeSignInSessions call; some operators additionally register a device against the stolen refresh token to mint a Primary Refresh Token (PRT), extending silent access and in some cases sidestepping device-compliance Conditional Access checks.

EvilTokens escalated the technique — first weaponized by the Russian state actor Storm-2372 in campaigns Microsoft disclosed in February 2025, then commoditized by the financially motivated group TA2723 by September 2025 — into a fully AI-driven commercial platform. Internally it pipelines three LLMs: Meta Llama 3.1 (8B) to ingest up to 5,000 harvested emails per mailbox and flag exploitable payment threads, Meta Llama 3.3 (70B) to draft contextually tailored business-email-compromise messages, and OpenAI GPT-4o mini to machine-translate stolen mail for multilingual targeting — automating what used to require a human operator reading a compromised inbox. The kit ran on Cloudflare Workers (brand-impersonating *.workers.dev landing pages such as adobe-[a-z0-9]{3}.*-s-account.workers.dev) fronted by Railway.com-hosted Node.js polling infrastructure that spun up thousands of short-lived device-code-polling nodes, plus roughly 32 self-hosted affiliate domains and a webmail-style admin panel for direct mailbox access, forwarding-rule abuse, and outbound BEC/invoice-fraud campaigns. Pricing ran $1,500 one-time plus $500/month for the core Office 365 device-code kit, with add-ons ($600 B2B sender module, $1,000 SMTP sender, $500 lifetime multi-account portal license) sold through a Telegram bot network run under the operator alias 'eviltokensadmin'; roughly 280 subscribers were in the private channel by March 19, 2026, growing to an estimated 1,000 active users and over 1,000 phishing domains by the time of takedown.

A Microsoft Digital Crimes Unit (DCU)-led coalition — Health-ISAC, Cloudflare, OpenAI, Shadowserver, TRM Labs, SpyCloud, Coinbase, and the UK Metropolitan Police Service — obtained a US federal court order on September 15, 2026 authorizing seizure of 50 websites and 175+ supporting domains. SpyCloud identified 8,708 compromised accounts across 6,585 corporate domains (97.5% enterprise) spanning 79 countries, led by the US, Canada, Australia, UK, and Saudi Arabia. Coinbase traced roughly $1.1 million in subscriber deposits across 1,000+ transactions from 700+ distinct cryptocurrency addresses through June 2026; the FBI's Internet Crime Complaint Center separately linked 13+ complaints totaling roughly $1.7 million in reported losses — both figures acknowledged as conservative given underreporting. On September 18, 2026, the Metropolitan Police Service executed warrants at addresses in Canary Wharf and Nine Elms, arresting two men (32 and 38) suspected of administering the EvilTokens site; both were released on bail pending further investigation. Microsoft's Associate General Counsel Steven Masada characterized the shift bluntly: 'AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible.' Microsoft and Metropolitan Police officials both cautioned that seizing infrastructure disrupts but does not eliminate the underlying technique — a related PhaaS operation, Tycoon 2FA, resumed device-code phishing from backed-up codebases within weeks of its own March 2026 coalition takedown.

MITRE ATT&CK techniques by tactic:

Discovery

T1087.004 Cloud Account

Persistence

T1098.005 Device Registration

Collection

T1114.002 Remote Email Collection; T1114.003 Email Forwarding Rule; T1119 Automated Collection; T1213.002 Sharepoint

Credential Access

T1187 Forced Authentication; T1528 Steal Application Access Token

Execution

T1204.001 Malicious Link

Lateral Movement

T1534 Internal Spearphishing

lateral-movement

T1550.001 Application Access Token

Initial Access

T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Resource Development

T1583.006 Web Services; T1588.002 Tool

Reconnaissance

T1591.004 Identify Roles

Impact

T1657 Financial Theft

Defense Evasion

T1684.001 Impersonation

Remediation for Storm-2992 EvilTokens PhaaS

Patches

• No vendor patch applies — EvilTokens abuses legitimate OAuth 2.0 Device Authorization Grant behavior (RFC 8628) rather than a software defect; mitigation is policy-based (Conditional Access), not patch-based

Immediate actions

• Block or tightly restrict the OAuth 2.0 Device Authorization Grant flow via Conditional Access for all users/applications without a documented business need (kiosks, IoT, print and meeting-room devices)
• Query 90 days of Entra ID sign-in logs for authenticationProtocol: deviceCode / originalTransferMethod: deviceCodeFlow and investigate any occurrence outside an approved baseline
• For any suspected compromise, immediately call revokeSignInSessions via Microsoft Graph — password resets alone do NOT invalidate the 90-day refresh tokens EvilTokens harvests
• Add the observed Railway.com polling-node IP ranges (162.220.232.0/24, 162.220.234.0/24) to Entra ID Named Locations with block policies, or block at the network perimeter
• Audit and remove unauthorized device registrations created in Entra ID within 48 hours of any suspicious device-code sign-in, and review mailbox forwarding/inbox rules created in the same window

Workarounds

• Where device code flow cannot be fully disabled, restrict polling/authorization to documented corporate egress IP ranges via Conditional Access location policies
• Enable Safe Links and anti-phishing policies in Microsoft Defender for Office 365 tuned to lures impersonating Adobe Acrobat, DocuSign, and SharePoint/payroll notifications

Longer-term hardening

• Deprecate device code flow organization-wide via Conditional Access and require phishing-resistant authentication (FIDO2 security keys, Windows Hello for Business, Authenticator with passkey) for all users
• Build identity-layer detection around Entra ID Protection signals (RiskLevelDuringSignIn, ErrorCode 50199 followed by success within 5 minutes) rather than relying on email-gateway or endpoint controls, since device-code phishing produces no malicious attachment or credential-harvesting page for them to catch
• Implement periodic OAuth application-consent and device-registration attestation reviews across the tenant
• Apply least-privilege Microsoft Graph API scopes and alert on bulk mailbox/SharePoint/OneDrive access patterns consistent with automated, AI-driven inbox triage

Affected and fixed versions

• Microsoft — Microsoft 365 / Entra ID — OAuth 2.0 Device Authorization Grant (device code flow)
  Vulnerable versions: any Entra ID tenant with device code authentication enabled and not restricted by Conditional Access
  Fixed in: not applicable — protocol-abuse, not a software vulnerability; mitigated via Conditional Access policies blocking/restricting Device Code Flow and mandatory refresh-token revocation

Timeline of Storm-2992 EvilTokens PhaaS

• 2025-02-13 Microsoft publicly discloses Storm-2372, the Russian state actor whose device-code phishing campaigns against government/academic targets pioneered the technique locked-ioc-20 later commoditized.
• 2025-09-01 Financially motivated group TA2723 commoditizes device-code phishing outside state-sponsored operations, per Cloud Security Alliance research note timeline.
• 2026-02-15 locked-ioc-20 phishing-as-a-service kit launches, first offering device-code authentication abuse at commercial scale with AI-assisted lure generation.
• 2026-02-19 Huntress identifies the first EvilTokens-driven compromise wave; within five weeks the campaign reaches 340+ Microsoft 365 organizations across seven countries.
• 2026-03-19 locked-ioc-20' private Telegram subscriber channel reaches roughly 280 members.
• 2026-03-23 locked-ioc-20 phishing infrastructure surpasses 1,000 live domains hosting device-code phishing pages, per Sekoia tracking.
• 2026-04-06 Microsoft Security Blog documents a significant AI-enabled escalation of device-code phishing tied to the locked-ioc-20 PhaaS toolkit, publishing IOCs and hunting queries.
• 2026-06-30 Coinbase's tracing window closes having identified roughly $1.1 million in subscriber deposits across 1,000+ transactions from 700+ distinct cryptocurrency addresses tied to locked-ioc-20.
• 2026-08-01 Microsoft receives information identifying locked-ioc-20' operators and notifies the UK Metropolitan Police Service.
• 2026-09-15 A US federal court grants the coalition's order authorizing seizure of 50 locked-ioc-20 websites and 175+ supporting domains.
• 2026-09-18 UK Metropolitan Police execute warrants at addresses in Canary Wharf and Nine Elms, London, arresting two men aged 32 and 38 suspected of administering locked-ioc-20; both are released on bail.
• 2026-09-22 Microsoft's Digital Crimes Unit and coalition partners publicly disclose the takedown, victim scale (12,000+ inboxes, 10,000+ organizations, 79 countries), and FBI IC3-linked loss figures (~$1.7M across 13+ complaints).

Sources cited for Storm-2992 EvilTokens PhaaS

• Storm-2372 conducts device code phishing campaign Microsoft · Vendor report · 2025-02-13
• Inside an AI-enabled device code phishing campaign Microsoft · Vendor report · 2026-04-06
• New widespread EvilTokens kit: device code phishing as-a-service (Part 1) sekoia.com · Research · 2026-03-31
• EvilTokens and the Rise of AI-Powered Phishing Huntress · Research · 2026-04-01
• CSA Research Note: EvilTokens — Device-Code Phishing Renders MFA Irrelevant labs.cloudsecurityalliance.org · Research · 2026-05-01
• CSA Research Note: OAuth Device Code Phishing and Microsoft 365 labs.cloudsecurityalliance.org · Research · 2026-03-25
• EvilTokens: The Phishing Kit That Renders Your MFA Useless apolocybersecurity.com · Blog · 2026-03-20
• EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts BleepingComputer · News · 2026-09-22
• New EvilTokens service fuels Microsoft device code phishing attacks BleepingComputer · News · 2026-04-01
• EvilTokens abuses Microsoft device code flow for account takeovers csoonline.com · News · 2026-03-25
• Microsoft-led coalition dismantles EvilTokens cybercrime-as-a-service operation cyberscoop.com · Article · 2026-09-18

Threats related to Storm-2992 EvilTokens PhaaS

• Device Code Authentication Phishing Abusing Microsoft Sign-In via Fake Mimecast Device Enrollment
• Browser Trust Abuse: Fake Update Lures, Browser-in-the-Browser, ClickFix and Device Code Phishing
• AI-Enabled Social Engineering and Synthetic Media (Deepfakes) Undermining Identity Verification

More from Storm-2992

• EvilTokens (Storm-2992): AI-Chatbot Device-Code Phishing Service Disrupted by Microsoft DCU, Plus AI-Enabled Deepfake and Crypto Drainer Fraud (TRM Labs)

Previous and next in threat intel

• Iran Exploits SS7 Cellular Interconnect Infrastructure to Track US Military Personnel Previous report
• Attackers Manipulate AI Chatbots (ChatGPT, Gemini, Copilot, AI Overviews) via SEO/Content Poisoning for Mass Disinformation, Malvertising, and Cryptojacking Next report