[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHrpum3yxNvbJFKPQGfK7yG4mUnx3ERxGNNVqRz44MLc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"d5461165-d458-4d37-bde8-a650f6ca1fdd","ai-powered-device-code-phishing-platform-compromises-12000-inboxes","694f4a95-7698-46c3-ab62-670766b0544c","AI-Powered Device Code Phishing Platform Compromises 12,000+ Inboxes","EvilTokens exploited the OAuth device code authentication flow — a legitimate mechanism designed for input-constrained devices — to trick users into granting persistent access tokens to attackers, bypassing traditional credential-based defenses like MFA. Because device code authentication tokens remain valid even after password resets, attackers achieved long-term persistence inside victim environments without needing ongoing user interaction. The use of AI to craft highly personalized phishing lures dramatically lowered the skill barrier for launching convincing Business Email Compromise campaigns at scale. This attack chain highlights how legitimate platform features can be weaponized when organizations lack controls restricting which authentication flows are permitted. The consequences extend beyond individual inboxes, as compromised accounts are frequently leveraged for lateral movement, financial fraud, and further phishing campaigns targeting trusted contacts.","**Immediate actions:**\n- Restrict or disable the OAuth device code authentication flow for users who do not require it via Conditional Access policies in your identity provider.\n- Audit all existing OAuth application consents and revoke any tokens associated with unrecognized or suspicious applications.\n- Force token revocation and re-authentication for all accounts suspected of compromise, as password resets alone do not invalidate stolen tokens.\n\n**Long-term improvements:**\n- Implement phishing-resistant MFA (e.g., FIDO2\u002Fpasskeys) organization-wide to reduce reliance on token-based authentication flows that can be abused.\n- Establish an allowlist of approved OAuth applications and enforce policies that block user consent to unvetted third-party apps.\n- Conduct regular security awareness training specifically covering device code phishing, QR code lures, and consent phishing techniques.\n\n**Detection measures:**\n- Enable and monitor sign-in logs and OAuth consent grants for anomalous device code authentication requests originating from unexpected locations or devices.\n- Configure alerts for high-volume email access, inbox rule creation, or forwarding rules that may indicate a compromised mailbox being exploited for BEC.\n- Integrate threat intelligence feeds to identify known PhaaS infrastructure (e.g., EvilTokens C2 domains) and block them at the network perimeter.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 8 – Audit Log Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","MITRE ATT&CK T1528 – Steal Application Access Token","MITRE ATT&CK T1566 – Phishing","GDPR Article 32 – Security of Processing (for EU-affected organizations)","ITIL – Incident Management & Access Management practices",{},"published","2026-09-22T16:20:43.30269+00:00","2026-09-22T16:20:43.148+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F09\u002F22\u002Funmasking-eviltokens-getting-to-the-root-of-device-code-phishing\u002F","unmasking-eviltokens-getting-to-the-root-of-device-code-phishing-6072e1","Unmasking EvilTokens: Getting to the root of device code phishing",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":41,"name":42,"slug":43,"description":44,"color":45},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":47,"name":48,"slug":49,"description":50,"color":51},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[54,58,62],{"slug":55,"name":56,"problem":57},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":59,"name":60,"problem":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":63,"name":64,"problem":65},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]