Fast Facts
- EvilTokens is a new, AI-generated Phishing-as-a-Service platform exploiting Microsoft’s device code authentication flow to covertly steal Microsoft 365 accounts, impacting organizations worldwide.
- It hijacks the legitimate OAuth 2.0 device code process, tricking victims into authenticating on phishing pages that grant attackers long-term access via tokens, some lasting up to 90 days or more.
- The platform operates through Telegram bots, offering templates, AI automation, and is suspected to expand support to Gmail and Okta phishing schemes, targeting roles vulnerable to Business Email Compromise (BEC).
- Organizations should disable device code authentication flows, monitor suspicious sign-ins, and employ detection tools like YARA rules to defend against EvilTokens’ sophisticated attacks.
What’s the Problem?
In early 2026, a new cybercrime tool called EvilTokens surfaced within underground communities, revolutionizing phishing methods. Unlike traditional techniques that imitate Microsoft login pages, EvilTokens exploits a legitimate Microsoft device code authentication flow, allowing attackers to silently access victims’ accounts once they trick users into entering a code. Operated via Telegram bots, this platform supplies cybercriminals with customizable phishing pages, email harvesting tools, and AI-automated features, making it highly effective for Business Email Compromise (BEC) and Middle-in-the-Middle attacks targeting organizations across various continents. Researchers from Sekoia’s Threat Detection and Research team discovered EvilTokens in March 2026, noting that it is the first known platform to provide turnkey Microsoft device code phishing pages, likely generated with artificial intelligence. This tool has resulted in compromised accounts from countries such as the US, Australia, and India, particularly affecting employees in finance, HR, and logistics—roles most vulnerable to scam tactics. The security breach occurs when victims unknowingly authenticate their accounts via malicious phishing pages, giving attackers prolonged access through tokens that can last up to 90 days and even enable silent, password-free login across Microsoft 365 services. Consequently, cybersecurity professionals advise disabling device code flows for non-essential users, monitoring suspicious sign-ins, and educating employees about the risks associated with device authentication to mitigate further damage.
Risk Summary
The rise of EvilTokens as a new phishing-as-a-service platform poses a serious risk to businesses that rely on Microsoft accounts. When cybercriminals exploit such platforms, they can easily breach your company’s security by stealing login credentials. Once compromised, attackers can access sensitive data, disrupt daily operations, and damage your reputation. Consequently, your business faces financial loss, customer distrust, and legal liabilities. Moreover, the sophisticated nature of these platforms makes detection difficult, increasing the chance of prolonged breaches. Hence, any organization using Microsoft services must be vigilant, as falling victim can disrupt its stability and long-term success.
Possible Action Plan
In an era where cyber threats evolve rapidly, swift remediation is crucial to minimize damage, protect sensitive data, and maintain trust. Addressing the threat posed by “EvilTokens” as a new phishing-as-a-service platform targeting Microsoft accounts requires immediate action to prevent widespread account compromise and limit attacker access.
Detection and Analysis
- Monitor security alerts related to phishing campaigns and suspicious activity involving tokens.
- Conduct thorough investigations to identify compromised accounts and vulnerable endpoints.
Containment Measures
- Immediately disable or reset affected accounts and revoked compromised tokens.
- Isolate affected systems to prevent lateral movement within the network.
Eradication Procedures
- Remove malicious components or access points introduced by EvilTokens.
- Patch known vulnerabilities that facilitate token theft or exploitation.
Recovery Actions
- Reinstate accounts with strengthened authentication measures, such as multi-factor authentication (MFA).
- Restore impacted systems from clean backups ensuring no malicious artifacts remain.
Preventative Strategies
- Educate users on recognizing phishing attempts and suspicious links.
- Implement continuous security monitoring and automated alerting for anomalies.
- Enforce strict access controls and regular credential updates to minimize risk.
Documentation and Reporting
- Record incident details and remediation steps for compliance and future reference.
- Notify relevant stakeholders and authorities if required by regulations.
Advance Your Cyber Knowledge
Discover cutting-edge developments in Emerging Tech and industry Insights.
Explore engineering-led approaches to digital security at IEEE Cybersecurity.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1cyberattack-v1-multisource
