[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmLC4S6DjKw9UEUztkk0lw5xO8XgZJuYfiPFJzMnsJIU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":59},"405adfa9-9798-40bc-99f5-9442b96fabcb","ai-powered-device-code-phishing-compromises-12000-inboxes","46001668-4e40-4f52-98d0-3fb8480bf015","AI-Powered Device-Code Phishing Compromises 12,000 Inboxes","The EvilTokens service exploited the OAuth device-code authentication flow — a legitimate mechanism designed for input-limited devices — to trick users into granting persistent access tokens to attackers without ever capturing a password. Once tokens were harvested, an embedded AI chatbot autonomously analyzed victim inboxes, mapped trusted relationships, and generated highly convincing impersonation messages to propagate fraud further. This attack demonstrates that modern phishing has evolved beyond credential theft into AI-assisted, token-based account takeover that bypasses MFA entirely. The scale of 12,000 compromised inboxes underscores how quickly automated, platform-as-a-service cybercrime tools can amplify a single attacker's reach. Organizations that rely solely on password-based or traditional MFA defenses are increasingly exposed to token-hijacking techniques.","**Immediate actions:**\n- Block or restrict the OAuth device-code authentication flow (grant type `urn:ietf:params:oauth:grant-type:device_code`) in your identity provider for users who do not require it.\n- Audit existing OAuth application consents and revoke any suspicious or unrecognized token grants across all mailboxes.\n- Enable Conditional Access policies that flag or block authentication requests originating from unfamiliar devices or unexpected geolocations.\n\n**Security awareness measures:**\n- Train users to recognize device-code phishing lures (e.g., unsolicited prompts asking them to visit a URL and enter a code) and report them immediately.\n- Run simulated device-code phishing exercises to measure and improve employee recognition rates.\n\n**Long-term improvements:**\n- Enforce phishing-resistant MFA methods (FIDO2\u002Fpasskeys) as a baseline, reducing reliance on token flows susceptible to interception.\n- Implement continuous monitoring and anomaly detection on mailbox access patterns to catch AI-driven lateral phishing campaigns early.\n- Establish a formal OAuth application governance program that requires periodic review and least-privilege scoping of all third-party app integrations.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-63B: Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST IR-4: Incident Handling","NIST SI-10: Information Input Validation","MITRE ATT&CK T1528: Steal Application Access Token","MITRE ATT&CK T1566: Phishing","OAuth 2.0 RFC 8628: Device Authorization Grant (risk awareness)","GDPR Article 32: Security of Processing (obligation to prevent unauthorized access to personal data)",{},"published","2026-09-22T18:21:01.746964+00:00","2026-09-22T18:21:01.457+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fmicrosoft-takes-down-eviltokens-device.html","microsoft-takes-down-eviltokens-device-code-phishing-service-tied-to-12-000-inbo-ac1280","Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":41,"name":42,"slug":43,"description":44,"color":45},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":47,"name":48,"slug":49,"description":50,"color":51},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[53],{"id":54,"date":55,"edition":56,"title":57,"audio_url":58},"16378340-cf57-4c03-9824-6475aac2ff72","2026-09-23","morning","ThreatNoir Morning Brief — September 23","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-23\u002Fthreatnoir-morning-brief-2026-09-23.mp3",[60,64,68],{"slug":61,"name":62,"problem":63},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":65,"name":66,"problem":67},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":69,"name":70,"problem":71},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]