[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWYF6nK6_aReoKzdaQ5UR0KC6D4lOynjTmRZ1oxwH-pc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"d92dd18b-76ed-4554-9ecf-6175105e60c9","eviltokens-phishing-as-a-service-exploits-device-code-authentication-flow","70d01021-0ea5-4838-9c40-bcbe2a071914","EvilTokens Phishing-as-a-Service Exploits Device Code Authentication Flow","The EvilTokens operation exploited Microsoft's device code authentication flow — a legitimate feature designed for input-constrained devices — to trick users into granting persistent OAuth tokens to attacker-controlled applications. Once a token is captured, attackers gain long-term access to Microsoft 365 accounts without needing the user's password or MFA code, effectively bypassing standard credential protections. This matters because phishing-as-a-service platforms lower the technical barrier for attackers, enabling even unsophisticated threat actors to launch enterprise-grade credential theft campaigns at scale. Microsoft's takedown of 50 websites and 150+ domains highlights how critical infrastructure disruption is becoming a key defensive lever, but organizations cannot rely solely on vendor intervention to protect their users.","**Immediate actions:**\n- Disable or restrict the OAuth device code flow in Azure AD Conditional Access policies unless it is explicitly required for specific devices.\n- Audit current OAuth application consents across your Microsoft 365 tenant and revoke any unrecognized or overly permissive token grants.\n\n**Security awareness measures:**\n- Train users to never approve device code authentication prompts they did not personally initiate, treating unsolicited requests as a red flag.\n- Run simulated device code phishing exercises to build organizational muscle memory for recognizing this specific attack vector.\n\n**Detection and long-term improvements:**\n- Enable Microsoft Entra ID (Azure AD) sign-in logs and alert on device code authentication events originating from unexpected geographies or devices.\n- Implement Conditional Access policies requiring compliant, managed devices and named locations before permitting OAuth token issuance.\n- Adopt a Zero Trust posture by continuously validating session integrity and enforcing token lifetime limits with refresh token revocation capabilities.",[12,13,14,15,16,17,18,19,20,21,22],"NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 SI-3 (Malicious Code Protection)","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","CIS Control 16: Application Software Security","MITRE ATT&CK T1528 (Steal Application Access Token)","MITRE ATT&CK T1566 (Phishing)","Microsoft Secure Score – Identity Improvement Actions","GDPR Article 32 (Security of Processing)",{},"published","2026-09-22T22:21:55.739806+00:00","2026-09-22T22:21:55.631+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.darkreading.com\u002Fidentity-access-management-security\u002Fmicrosoft-disrupts-eviltokens-device-code-phishing-service","microsoft-disrupts-eviltokens-device-code-phishing-service-c75e5a","Microsoft Disrupts EvilTokens Device Code Phishing Service",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":39,"name":40,"slug":41,"description":42,"color":43},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":45,"name":46,"slug":47,"description":48,"color":49},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[52,56,60],{"slug":53,"name":54,"problem":55},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":57,"name":58,"problem":59},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":61,"name":62,"problem":63},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]