Quick Takeaways
-
AI accelerates familiar attacks: EvilTokens uses Microsoft’s OAuth device-authorization flow to access Microsoft 365 accounts—without fake login pages—then uses AI to analyze business activity and guide fraud attempts.
-
The danger is what happens after access: AI can quickly identify payment decision-makers, trusted relationships and useful conversations, then craft convincing impersonation messages.
-
Response-time metrics aren’t enough: MTTD and MTTR matter less if attackers can reach damaging outcomes before detection or containment. Measure how quickly an attack can reach impact.
- Test defenses as a connected system: Rehearse realistic, end-to-end attack paths to find gaps and stop attackers before they advance—not just after an incident begins.
Underlying Problem
CSO Online reports that EvilTokens, a phishing-as-a-service platform first identified in February 2026, helped cybercriminals gain access to Microsoft 365 accounts through a legitimate OAuth device-authorization process. Instead of stealing passwords, the scheme tricked users into approving access. Once inside, AI analyzed inboxes and business activity, then identified payment decision-makers, trusted relationships, and invoices that could support fraud. It also helped attackers choose impersonation targets and draft convincing messages.
The victims were organizations and employees whose Microsoft 365 accounts could expose sensitive business conversations or payment processes. The platform’s AI made it easier and faster for attackers to decide what to do after gaining access, leaving defenders less time to intervene. Microsoft said the operation used AI throughout the attack chain and linked it to Storm-2992, a threat actor it believed was behind the scheme. CSO Online’s report emphasizes that organizations should test their defenses across complete attack scenarios, not just measure how quickly they detect or respond to isolated threats.
Risk Summary
EvilTokens shows how AI can make familiar attacks faster, more convincing, and easier to adapt. That threat can reach any business, not only large firms or technology companies. If attackers steal an employee’s access token, they may enter systems without triggering defenses designed mainly for passwords. From there, they could expose customer records, disrupt operations, divert payments, or use trusted accounts to target suppliers and clients. The damage can spread quickly: lost revenue, recovery costs, legal obligations, and lasting reputational harm. Yet AI does not make these attacks inevitable. Businesses can reduce their exposure with phishing-resistant authentication, strict access controls, prompt token revocation, continuous monitoring, and practiced response plans. Crucially, defenses must protect the session—not just the sign-in.
Possible Action Plan
EvilTokens shows how convincing, scalable lures can be paired with token theft; timely remediation can stop one compromised sign-in from becoming wider access.
Priority Actions
- Restrict risky sign-in methods. Disable OAuth device-code authentication where it is not needed, or tightly limit who can use it and from which locations.
- Strengthen identity protection. Require phishing-resistant MFA, such as passkeys or security keys, and apply Conditional Access policies to block suspicious sign-ins.
- Limit application access. Restrict user consent to OAuth applications, review approved integrations, and remove unrecognized or unnecessary permissions.
- Watch identity activity. Monitor sign-in and audit logs for unusual device-code requests, unfamiliar applications, suspicious consent grants, and unexpected token use.
- Contain suspected compromise quickly. Revoke active sessions and refresh tokens, reset affected credentials, remove malicious app grants, and investigate related accounts and devices.
- Prepare users and responders. Train staff to verify unexpected authentication requests through a separate channel, and maintain a clear process for reporting and handling suspected phishing.
- Review and improve controls. Following the NIST CSF’s Govern, Identify, Protect, Detect, Respond, and Recover functions, document the incident, address control gaps, and confirm that legitimate access has been restored safely.
Explore More Security Insights
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
