[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwpNdo3B-2V5feWpcxNNyIyotckZRlLkCz8S3q0QzhcY":3},{"article":4,"iocs":47,"watch_terms":50,"solutions":51,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"70d01021-0ea5-4838-9c40-bcbe2a071914","Microsoft Disrupts EvilTokens Device Code Phishing Service","microsoft-disrupts-eviltokens-device-code-phishing-service-c75e5a","Microsoft seized 50 websites and disabled more than 150 domains as part of a coordinated disruption effort against a phishing-as-a-service platform targeting Microsoft 365 accounts.","Microsoft disrupted EvilTokens, a phishing-as-a-service platform targeting Microsoft 365 accounts, by seizing 50 websites and disabling over 150 domains. The operation targeted the infrastructure used to conduct device code phishing attacks against enterprise users. This coordinated takedown reflects Microsoft's efforts to dismantle high-impact credential theft operations.","Microsoft disrupts EvilTokens phishing service, seizing 50 websites and disabling 150+ domains.","https:\u002F\u002Fwww.darkreading.com\u002Fidentity-access-management-security\u002Fmicrosoft-disrupts-eviltokens-device-code-phishing-service","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt3163f248ce2f1013\u002F6ab2d46dc8295fafe642a234\u002Fskull_coins-breakermaximus-GettyImages-2092767456.jpg?width=720&quality=80&disable=upscale","2026-09-22T20:02:02+00:00","2026-09-22T22:00:37.853057+00:00",8,[17,20,23],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"EvilTokens","campaign",{"name":24,"type":25},"Microsoft 365","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":30,"value":21,"context":49},"Phishing-as-a-service platform targeting Microsoft 365 accounts via device code phishing",[18],{"controls":52,"vendors":135},[53,82,110],{"slug":54,"name":55,"problem":56,"products":57},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":83,"name":84,"problem":85,"products":86},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":104,"vendor_name":18,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":111,"name":112,"problem":113,"products":114},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[115,121,128],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":117,"url":119,"description":120},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":111,"product_name":125,"url":126,"description":127},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":129,"product_name":132,"url":133,"description":134},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[136],{"slug":104,"name":18,"logo_path":105,"roles":137},[138],"reported_by",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":155},"eviltokens-phishing-as-a-service-exploits-device-code-authentication-flow","EvilTokens Phishing-as-a-Service Exploits Device Code Authentication Flow","The EvilTokens operation exploited Microsoft's device code authentication flow — a legitimate feature designed for input-constrained devices — to trick users into granting persistent OAuth tokens to attacker-controlled applications. Once a token is captured, attackers gain long-term access to Microsoft 365 accounts without needing the user's password or MFA code, effectively bypassing standard credential protections. This matters because phishing-as-a-service platforms lower the technical barrier for attackers, enabling even unsophisticated threat actors to launch enterprise-grade credential theft campaigns at scale. Microsoft's takedown of 50 websites and 150+ domains highlights how critical infrastructure disruption is becoming a key defensive lever, but organizations cannot rely solely on vendor intervention to protect their users.",[144,145,146,147,148,149,150,151,152,153,154],"NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 SI-3 (Malicious Code Protection)","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","CIS Control 16: Application Software Security","MITRE ATT&CK T1528 (Steal Application Access Token)","MITRE ATT&CK T1566 (Phishing)","Microsoft Secure Score – Identity Improvement Actions","GDPR Article 32 (Security of Processing)",{}]