[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fajSoaTaWMj5WkZeU6vpJXQ169ou2FHrRoGIl58SWENA":3},{"article":4,"iocs":56,"watch_terms":57,"solutions":58,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"694f4a95-7698-46c3-ab62-670766b0544c","Unmasking EvilTokens: Getting to the root of device code phishing","unmasking-eviltokens-getting-to-the-root-of-device-code-phishing-6072e1","EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption of EvilTokens infrastructure and operations. The post Unmasking EvilTokens: Getting to the root of device code phishing appeared first on Microsoft Security Blog.","EvilTokens, an AI-powered phishing-as-a-service (PhaaS) platform, has been disrupted by Microsoft's Digital Crimes Unit. The platform enabled sophisticated business email compromise (BEC) campaigns, compromising over 12,000 inboxes worldwide by abusing device code authentication to steal tokens and maintain persistence. Microsoft attributes the development and support of EvilTokens to threat actor Storm-2992 and highlights the platform's use of AI for tailoring lures and analyzing compromised inboxes.","Microsoft disrupts EvilTokens, an AI-powered phishing-as-a-service platform.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F09\u002F22\u002Funmasking-eviltokens-getting-to-the-root-of-device-code-phishing\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FEvilTokens-featured-image-1.png","2026-09-22T15:00:00+00:00","2026-09-22T16:00:59.189121+00:00",8,[17,20,23,26,29,31],{"name":18,"type":19},"Microsoft Defender for Endpoint","product",{"name":21,"type":22},"Storm-2992","threat_actor",{"name":24,"type":25},"EvilTokens","campaign",{"name":27,"type":28},"Phishing-as-a-service","technology",{"name":30,"type":28},"Business email compromise",{"name":32,"type":28},"Adversary-in-the-middle","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":55},{"id":33,"icon":35,"name":36,"slug":37},[],[18],{"controls":59,"vendors":138},[60,89,112],{"slug":61,"name":62,"problem":63,"products":64},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":90,"name":91,"problem":92,"products":93},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[94,102,107],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":103,"product_name":104,"url":105,"description":106},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":108,"product_name":109,"url":110,"description":111},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":113,"name":114,"problem":115,"products":116},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[117,125,130],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":126,"product_name":127,"url":128,"description":129},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[139],{"slug":74,"name":75,"logo_path":76,"roles":140},[141],"reported_by",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":160},"ai-powered-device-code-phishing-platform-compromises-12000-inboxes","AI-Powered Device Code Phishing Platform Compromises 12,000+ Inboxes","EvilTokens exploited the OAuth device code authentication flow — a legitimate mechanism designed for input-constrained devices — to trick users into granting persistent access tokens to attackers, bypassing traditional credential-based defenses like MFA. Because device code authentication tokens remain valid even after password resets, attackers achieved long-term persistence inside victim environments without needing ongoing user interaction. The use of AI to craft highly personalized phishing lures dramatically lowered the skill barrier for launching convincing Business Email Compromise campaigns at scale. This attack chain highlights how legitimate platform features can be weaponized when organizations lack controls restricting which authentication flows are permitted. The consequences extend beyond individual inboxes, as compromised accounts are frequently leveraged for lateral movement, financial fraud, and further phishing campaigns targeting trusted contacts.",[147,148,149,150,151,152,153,154,155,156,157,158,159],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 8 – Audit Log Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","MITRE ATT&CK T1528 – Steal Application Access Token","MITRE ATT&CK T1566 – Phishing","GDPR Article 32 – Security of Processing (for EU-affected organizations)","ITIL – Incident Management & Access Management practices",{}]