[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fd9bKNamwF1dHhiFgLPjJXZlUiDEf92R3npeppQ1MAwg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"e9af188f-77c2-4de6-b9a0-5806e7e0c15a","eviltokens-phaas-bypasses-mfa-via-device-code-phishing-hits-12000-accounts","3b9e510d-01ae-44b7-a0a2-249ba2c6f6ea","EvilTokens PhaaS Bypasses MFA via Device-Code Phishing, Hits 12,000 Accounts","The EvilTokens platform exploited device-code phishing — a technique that tricks users into authorizing attacker-controlled sessions — effectively bypassing multi-factor authentication by stealing OAuth tokens rather than passwords. This highlights a critical blind spot: MFA alone is not a silver bullet when authentication flows themselves can be weaponized. Over 12,000 Microsoft accounts across 10,000 organizations were compromised, demonstrating the massive scale achievable through Phishing-as-a-Service commoditization. Organizations that assumed MFA guaranteed protection were left exposed because they lacked controls to detect or restrict unusual device-code authorization flows.","**Immediate actions:**\n- Disable or restrict the OAuth device-code authentication flow in Microsoft Entra ID (Azure AD) Conditional Access policies unless explicitly required by business needs.\n- Audit all recent device-code authorization grants and revoke suspicious or unrecognized OAuth tokens across your Microsoft 365 tenant.\n- Enable Conditional Access policies requiring compliant, managed devices and known locations before permitting token issuance.\n\n**Long-term improvements:**\n- Migrate users to phishing-resistant MFA methods (FIDO2 hardware keys or Windows Hello for Business) that are immune to token-hijacking attacks.\n- Implement a Zero Trust architecture that continuously validates session context, device health, and behavioral signals rather than trusting a token at face value.\n- Conduct regular security awareness training specifically covering device-code phishing scenarios and how to recognize unexpected authorization prompts.\n\n**Detection measures:**\n- Configure SIEM alerting on anomalous OAuth consent grants, device-code flow usage from unfamiliar locations, or bulk token issuance events.\n- Integrate threat intelligence feeds (e.g., SpyCloud, Microsoft Sentinel) to detect compromised credential indicators before attackers pivot deeper into the environment.\n- Establish a baseline of normal device-code authentication usage and alert on deviations exceeding defined thresholds.",[12,13,14,15,16,17,18,19,20,21,22,23],"NIST SP 800-63B (Phishing-Resistant Authenticators)","NIST AC-2 (Account Management)","NIST AC-17 (Remote Access)","NIST IR-4 (Incident Handling)","CIS Control 4 (Secure Configuration of Enterprise Assets)","CIS Control 6 (Access Control Management)","CIS Control 14 (Security Awareness and Skills Training)","CIS Control 17 (Incident Response Management)","MITRE ATT&CK T1528 (Steal Application Access Token)","MITRE ATT&CK T1566 (Phishing)","Microsoft Secure Score — Conditional Access Policy Recommendations","GDPR Article 32 (Security of Processing — appropriate technical measures)",{},"published","2026-09-22T16:21:25.829268+00:00","2026-09-22T16:21:25.436+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Feviltokens-phaas-disrupted-after-compromising-12-000-microsoft-accounts\u002F","eviltokens-phaas-disrupted-after-compromising-12-000-microsoft-accounts-684de1","EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[53,57,61],{"slug":54,"name":55,"problem":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":58,"name":59,"problem":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":62,"name":63,"problem":64},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]