EvilTokens

EvilTokens is a phishing-as-a-service platform built to compromise Microsoft 365 accounts by abusing the OAuth 2.0 Device Authorization Grant flow. Rather than harvesting passwords through counterfeit login pages, it tricks victims into entering an attacker-generated Microsoft device code on Microsoft’s legitimate device login page and completing normal authentication, including multi-factor authentication. This causes Microsoft to issue access and refresh tokens to the attacker-controlled session, enabling account takeover without direct credential theft.

The platform is associated with large-scale device code phishing activity observed since at least early 2026 and has been linked to account takeover, session hijacking, data theft, and business email compromise operations. Campaigns have used lures themed as invoices, shared documents, calendar invites, SharePoint access requests, voicemail notices, password expiry warnings, and document-signature workflows, often targeting finance, human resources, logistics, sales, and accounts-payable personnel. Delivery has been observed through phishing emails and malicious document attachments, and the service has been advertised and distributed via Telegram.

EvilTokens provides turnkey phishing templates and backend automation for device-code handling, token polling, token refresh, and post-compromise operations. Reported capabilities include generation and management of stolen Microsoft 365 tokens, conversion of harvested authentication material into longer-lived persistence through Primary Refresh Token workflows, browser single sign-on cookie generation, Outlook Web Access session generation, Microsoft Graph and Azure reconnaissance, and Telegram-based operator notifications. The ecosystem has also been tied to AI-assisted lure generation and business email compromise workflows, lowering the barrier to entry for affiliates.

The platform primarily targets Microsoft 365 and Microsoft Entra ID environments and enables access to victim email, files, Teams, SharePoint, and OneDrive resources. It has been used globally across multiple sectors and geographies, and related affiliate infrastructure such as ARToken has shown strong technical overlap with EvilTokens, including shared API patterns, deployment models, and post-compromise tradecraft. EvilTokens is notable for industrializing device code phishing at scale while reducing many traditional phishing indicators, since victims authenticate on legitimate Microsoft infrastructure rather than a fake sign-in page.