Unmasking EvilTokens: Getting to the root of device code phishing

EvilTokens exploited the OAuth device code authentication flow — a legitimate mechanism designed for input-constrained devices — to trick users into granting persistent access tokens to attackers, bypassing traditional credential-based defenses like MFA. Because device code authentication tokens remain valid even after password resets, attackers achieved long-term persistence inside victim environments without needing ongoing user interaction. The use of AI to craft highly personalized phishing lures dramatically lowered the skill barrier for launching convincing Business Email Compromise campaigns at scale. This attack chain highlights how legitimate platform features can be weaponized when organizations lack controls restricting which authentication flows are permitted. The consequences extend beyond individual inboxes, as compromised accounts are frequently leveraged for lateral movement, financial fraud, and further phishing campaigns targeting trusted contacts.