# Microsoft-Led Coalition Takes Down EvilTokens AI-Powered Phishing-as-a-Service Platform (Storm-2992)

> A Microsoft-led coalition (Health-ISAC, Cloudflare, OpenAI, Shadowserver, TRM Labs, SpyCloud, Coinbase, UK Metropolitan Police) obtained a federal court order on September 15, 2026 to seize 50 websites and 175+ supporting domains behind EvilTokens, an AI-augmented device-code phishing-as-a-service platform tracked as Storm-2992 that stole OAuth session/refresh tokens to bypass MFA and drove business email compromise at scale. Two operators (32 and 38) were arrested in Canary Wharf and Nine Elms, London on September 18, 2026; roughly 1,000 subscribers used the kit to compromise 12,000+ Microsoft 365 inboxes across 10,000+ organizations in 79 countries.

- **Published:** 2026-09-22T00:00:00Z
- **Last reviewed:** 2026-09-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2614
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-storm-2992-eviltokens-phaas-tl-2026-2614.webp?v=2746f085 (Threadlinqs threat intel: Microsoft Coalition Takes Down EvilTokens: Detection & IOCs (TL-2026-2614) — High severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-2614
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** MITIGATED
- **Actor:** Storm-2992
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

EvilTokens is a subscription phishing-as-a-service (PhaaS) kit, first observed mid-February 2026 and sold openly over Telegram, that weaponizes the OAuth 2.0 Device Authorization Grant — the flow Microsoft designed to let keyboardless devices (smart TVs, printers, Teams room devices) authenticate — to hijack Microsoft 365 accounts without ever touching a password or a fake login page. An operator requests a legitimate Microsoft device code and user code, then delivers it to a victim through a socially-engineered lure (fake Adobe Acrobat/DocuSign requests, invoice approvals, SharePoint notifications, payroll or security alerts, sometimes via PDF/HTML/DOCX/XLSX/SVG attachments carrying QR codes). The victim is directed to the real microsoft.com/devicelogin page, enters the code, and completes their own MFA challenge on genuine Microsoft infrastructure — at which point Microsoft issues the access and refresh tokens to the attacker's polling session instead of the victim's. The 90-day rolling refresh token survives password resets and is not revoked by MFA re-enrollment, only by an explicit revokeSignInSessions call; some operators additionally register a device against the stolen refresh token to mint a Primary Refresh Token (PRT), extending silent access and in some cases sidestepping device-compliance Conditional Access checks.

EvilTokens escalated the technique — first weaponized by the Russian state actor Storm-2372 in campaigns Microsoft disclosed in February 2025, then commoditized by the financially motivated group TA2723 by September 2025 — into a fully AI-driven commercial platform. Internally it pipelines three LLMs: Meta Llama 3.1 (8B) to ingest up to 5,000 harvested emails per mailbox and flag exploitable payment threads, Meta Llama 3.3 (70B) to draft contextually tailored business-email-compromise messages, and OpenAI GPT-4o mini to machine-translate stolen mail for multilingual targeting — automating what used to require a human operator reading a compromised inbox. The kit ran on Cloudflare Workers (brand-impersonating *.workers.dev landing pages such as adobe-[a-z0-9]{3}.*-s-account.workers.dev) fronted by Railway.com-hosted Node.js polling infrastructure that spun up thousands of short-lived device-code-polling nodes, plus roughly 32 self-hosted affiliate domains and a webmail-style admin panel for direct mailbox access, forwarding-rule abuse, and outbound BEC/invoice-fraud campaigns. Pricing ran $1,500 one-time plus $500/month for the core Office 365 device-code kit, with add-ons ($600 B2B sender module, $1,000 SMTP sender, $500 lifetime multi-account portal license) sold through a Telegram bot network run under the operator alias 'eviltokensadmin'; roughly 280 subscribers were in the private channel by March 19, 2026, growing to an estimated 1,000 active users and over 1,000 phishing domains by the time of takedown.

A Microsoft Digital Crimes Unit (DCU)-led coalition — Health-ISAC, Cloudflare, OpenAI, Shadowserver, TRM Labs, SpyCloud, Coinbase, and the UK Metropolitan Police Service — obtained a US federal court order on September 15, 2026 authorizing seizure of 50 websites and 175+ supporting domains. SpyCloud identified 8,708 compromised accounts across 6,585 corporate domains (97.5% enterprise) spanning 79 countries, led by the US, Canada, Australia, UK, and Saudi Arabia. Coinbase traced roughly $1.1 million in subscriber deposits across 1,000+ transactions from 700+ distinct cryptocurrency addresses through June 2026; the FBI's Internet Crime Complaint Center separately linked 13+ complaints totaling roughly $1.7 million in reported losses — both figures acknowledged as conservative given underreporting. On September 18, 2026, the Metropolitan Police Service executed warrants at addresses in Canary Wharf and Nine Elms, arresting two men (32 and 38) suspected of administering the EvilTokens site; both were released on bail pending further investigation. Microsoft's Associate General Counsel Steven Masada characterized the shift bluntly: 'AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible.' Microsoft and Metropolitan Police officials both cautioned that seizing infrastructure disrupts but does not eliminate the underlying technique — a related PhaaS operation, Tycoon 2FA, resumed device-code phishing from backed-up codebases within weeks of its own March 2026 coalition takedown.

## MITRE ATT&CK

- T1591.004 Identify Roles
- T1583.006 Web Services
- T1588.002 Tool
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1528 Steal Application Access Token
- T1187 Forced Authentication
- T1550.001 Application Access Token
- T1684.001 Impersonation
- T1098.005 Device Registration
- T1087.004 Cloud Account
- T1114.002 Remote Email Collection
- T1114.003 Email Forwarding Rule
- T1213.002 Sharepoint
- T1119 Automated Collection
- T1534 Internal Spearphishing
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**OAuth Device Code Phishing — Device Authorization Grant Abuse (EvilTokens/Storm-2992)** (`TL-2026-2614-SPL-001`)

Detects the EvilTokens exploitation chain: a phishing lure (Adobe Acrobat/DocuSign/SharePoint/payroll-themed PDF, DOCX, XLSX, SVG, or QR-code attachment) directs a victim to the legitimate microsoft.com/devicelogin or login.microsoftonline.com/common/oauth2/deviceauth endpoint to enter an attacker-supplied device code. Because the victim completes their own MFA on genuine Microsoft infrastructure, Microsoft issues the OAuth access/refresh tokens to the attacker's polling session (T1528) instead of the victim's, bypassing MFA without a fake login page or malware.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1566.002, T1204.001, T1528, T1187, T1591.004
- **Data sources:** azure_ad_signin_logs, microsoft_entra_id_signin_logs, email_security_gateway, proxy_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
`comment("EvilTokens/Storm-2992 exploitation: device-code auth combined with phishing lure delivery")`
index=azuread sourcetype="azure:aad:signin" earliest=-24h
| eval is_device_code=if(match(authenticationProtocol,"(?i)devicecode") OR match(authenticationRequirement,"(?i)devicecode") OR match(originalTransferMethod,"(?i)deviceCodeFlow") OR match(resultDescription,"(?i)device code"),1,0)
| where is_device_code=1
| eval railway_src=if(cidrmatch("162.220.232.0/24",src_ip) OR cidrmatch("162.220.234.0/24",src_ip),1,0)
| eval saw_50199=if(match(errorCode,"50199"),1,0)
| stats count as auth_events, values(resultDescription) as results, values(errorCode) as error_codes, max(railway_src) as railway_infra_seen, max(saw_50199) as saw_50199_flag, min(_time) as first_seen, max(_time) as last_seen by user, src_ip, appDisplayName
| where railway_infra_seen=1 OR auth_events>2
| join type=left user
    [ search index=email sourcetype="ms:o365:security_events" OR sourcetype="mimecast:siem:receipt" earliest=-24h
      (subject="*Adobe*" OR subject="*DocuSign*" OR subject="*SharePoint*" OR subject="*payroll*" OR subject="*invoice*" OR subject="*security alert*")
      (attachment_extension IN ("pdf","docx","xlsx","svg","html"))
    | rename recipient as user
    | stats count as lure_email_count values(subject) as lure_subjects values(attachment_extension) as lure_attachment_types by user ]
| convert ctime(first_seen) ctime(last_seen)
| sort - auth_events
```

### Microsoft KQL

```kql
let RailwayCIDRs = dynamic(["162.220.232.0/24","162.220.234.0/24"]);
let DeviceCodeSignins = SigninLogs
| where TimeGenerated > ago(24h)
| where AuthenticationProtocol == "deviceCode" or AuthenticationRequirement has "deviceCode" or ResultDescription has "device code"
| extend IsRailwayInfra = ipv4_is_match(IPAddress, "162.220.232.0/24") or ipv4_is_match(IPAddress, "162.220.234.0/24")
| extend Saw50199 = ResultType == "50199";
let LurePhish = EmailEvents
| where TimeGenerated > ago(24h)
| where Subject has_any ("Adobe", "DocuSign", "SharePoint", "payroll", "invoice", "security alert")
| where AttachmentCount > 0
| project RecipientEmailAddress, Subject, SenderFromDomain, TimeGenerated;
DeviceCodeSignins
| summarize AttemptCount = count(), ResultTypes = make_set(ResultType), IsRailwayInfra = max(toint(IsRailwayInfra)), Saw50199Flag = max(toint(Saw50199)), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserPrincipalName, IPAddress, AppDisplayName
| where IsRailwayInfra == 1 or AttemptCount > 2
| join kind=leftouter (LurePhish | project UserPrincipalName = RecipientEmailAddress, Subject, SenderFromDomain) on UserPrincipalName
| project UserPrincipalName, IPAddress, AppDisplayName, AttemptCount, ResultTypes, IsRailwayInfra, Saw50199Flag, FirstSeen, LastSeen, Subject, SenderFromDomain
```

### Sigma

```yaml
title: OAuth Device Code Phishing - EvilTokens/Storm-2992 Device Authorization Grant Abuse
id: 3f6a8b2e-9c4d-4e11-8a2f-1d6c9e7b5a01
status: experimental
description: Detects OAuth 2.0 Device Authorization Grant (RFC 8628) sign-ins consistent with EvilTokens/Storm-2992 device-code phishing, where a victim is lured (Adobe/DocuSign/SharePoint/payroll-themed attachment or QR code) into entering an attacker-supplied device code at the legitimate Microsoft device-login endpoint.
references:
    - https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/
    - https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/
    - https://cyberscoop.com/microsoft-eviltokens-cybercrime-service-takedown/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-22
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.t1566.002
    - attack.execution
    - attack.t1204.001
    - attack.credential-access
    - attack.t1528
    - attack.t1187
    - attack.tool.eviltokens
    - attack.group.storm-2992
logsource:
    product: azure
    service: signinlogs
detection:
    selection_devicecode:
        AuthenticationProtocol: 'deviceCode'
    selection_devicecode_alt:
        AuthenticationRequirement|contains: 'deviceCode'
    selection_railway_infra:
        IPAddress|cidr:
            - '162.220.232.0/24'
            - '162.220.234.0/24'
    condition: selection_devicecode or selection_devicecode_alt or selection_railway_infra
falsepositives:
    - Legitimate device-code flow for kiosks, Teams Rooms devices, smart TVs, printers, or CLI tools (Azure CLI, PowerShell, gh CLI) with a documented business need
    - Security awareness/phishing-simulation platforms mimicking Adobe/DocuSign/SharePoint lures for training
level: high
```

**Known false positives:**

- Legitimate device-code authentication for kiosks, Teams Rooms devices, smart TVs, printers, or CLI tools (Azure CLI, PowerShell) using the documented RFC 8628 business flow
- Security awareness/phishing-simulation platforms that mimic Adobe/DocuSign/SharePoint lures for training purposes

**Tuning notes:** Baseline and allowlist approved AppIds/device types that legitimately use device-code flow (e.g., specific IoT/kiosk service principals); tighten the Railway.com CIDR match into a hard Conditional Access block per remediation guidance; correlate with Entra ID Protection ErrorCode 50199 followed by a success within 5 minutes for higher-fidelity alerting.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- OAuth Device Code Phishing — Device Authorization Grant Abuse (EvilTokens/Storm-2992) (locked: unlock with TL Creds)
- Post-Compromise Token Abuse — Device Registration, PRT Minting & Mailbox Persistence (EvilTokens) (locked: unlock with TL Creds)
- EvilTokens C2 Polling Infrastructure & BEC Lateral Movement / Invoice Fraud (locked: unlock with TL Creds)
- OAuth Device Code Phishing — Device Authorization Grant Abuse (EvilTokens/Storm-2992) (locked: unlock with TL Creds)
- Post-Compromise Token Abuse — Device Registration, PRT Minting & Mailbox Persistence (EvilTokens) (locked: unlock with TL Creds)
- EvilTokens C2 Polling Infrastructure & BEC Lateral Movement / Invoice Fraud (locked: unlock with TL Creds)
- Post-Compromise Token Abuse — Device Registration, PRT Minting & Mailbox Persistence (EvilTokens) (locked: unlock with TL Creds)
- EvilTokens C2 Polling Infrastructure & BEC Lateral Movement / Invoice Fraud (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- IP address: `162.220.234[.]41`
- Domain: `authdocspro[.]com`
- IP address: `162.220.234[.]66`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Microsoft-led coalition dismantles EvilTokens cybercrime-as-a-service operation](https://cyberscoop.com/microsoft-eviltokens-cybercrime-service-takedown/)
- [EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts](https://www.bleepingcomputer.com/news/security/eviltokens-phaas-disrupted-after-compromising-12-000-microsoft-accounts/)
- [New EvilTokens service fuels Microsoft device code phishing attacks](https://www.bleepingcomputer.com/news/security/new-eviltokens-service-fuels-microsoft-device-code-phishing-attacks/)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Inside an AI-enabled device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/)
- [New widespread EvilTokens kit: device code phishing as-a-service (Part 1)](https://www.sekoia.com/blog/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/)
- [EvilTokens and the Rise of AI-Powered Phishing](https://www.huntress.com/resources/eviltokens-ai-powered-phishing-report)
- [EvilTokens abuses Microsoft device code flow for account takeovers](https://www.csoonline.com/article/4153742/eviltokens-abuses-microsoft-device-code-flow-for-account-takeovers.html)
- [CSA Research Note: EvilTokens — Device-Code Phishing Renders MFA Irrelevant](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-eviltokens-2026/)
- [CSA Research Note: OAuth Device Code Phishing and Microsoft 365](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-m365-20260325-c/)
- [EvilTokens: The Phishing Kit That Renders Your MFA Useless](https://www.apolocybersecurity.com/en/blog-posts/eviltokens-phaas-microsoft-365-mfa-bypass-oauth-device-code-flow)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2614