A phishing equipment subverting Microsoft’s legit authentication move lets attackers break into accounts with out stealing passwords or creating faux login pages
15 Jun 2026
•
,
5 min. learn
A lot has been written about how the times of phishing emails laden with damaged grammar and crude design are numbered, largely because of AI. In the meantime, EvilTokens provides a considerably completely different instance of how far the phishing craft has moved.
EvilTokens is a phishing-as-a-service (PhaaS) equipment constructed to compromise Microsoft 365 accounts by abusing the OAuth 2.0 machine authorization grant move. As assaults that use the equipment depend on machine code phishing, they sidestep the necessity for convincing replicas of real login pages the place the victims would hand over their passwords. As a substitute, attackers get the sufferer to finish a legit authentication course of – together with two-factor authentication (2FA) – on an actual Microsoft login web page.
The toolkit has been marketed by way of Telegram channels and noticed in energetic assaults since at the least February 2026. As documented by Sekoia and others, the equipment seems to have been rapidly adopted by cybercriminals and deployed in a variety of account takeover and enterprise e-mail compromise (BEC) assaults, together with for a marketing campaign concentrating on greater than 340 organizations in a number of international locations in March 2026. Microsoft itself has additionally described an AI-enabled marketing campaign that used dynamic device-code technology and bespoke lures to extend the success fee of EvilTokens assaults.
The internal workings of EvilTokens
Right here’s a quick overview of how assaults leveraging EvilTokens unfold:
- The assault itself is preceded by ‘reconnaissance’ the place the ne’er-do-wells first confirm that the goal account is energetic. Microsoft has seen this reconnaissance run 10 to fifteen days forward of the particular phishing try.
- The sufferer receives an e-mail or message that’s typically dressed up as an bill, shared doc, calendar invite, or SharePoint entry request. The lure entails a decoy web page impersonating a trusted model or service, together with easy wording equivalent to “Confirm to view” or “Signature required.”
- When the sufferer clicks by means of, the web page requests a tool code from Microsoft. The code is legitimate just for quarter-hour, therefore time and timing are of the essence right here. The web page exhibits the sufferer the code alongside and factors them to Microsoft’s real microsoft.com/devicelogin login portal. The catch is that the code belongs to the attacker’s session, therefore the sufferer unknowingly authorizes the attacker’s machine, not their very own.
- Seeing a sound sign-in, Microsoft points entry and refresh tokens to the session opened by the attacker. As soon as inside, the criminals can entry company e-mail, recordsdata, Groups, SharePoint, OneDrive, and different Microsoft 365 sources and exfiltrate information or put together BEC assaults, which is why finance, HR, logistics, and gross sales accounts draw a lot of the attackers’ curiosity.
What makes EvilTokens harmful
The OAuth machine code move was designed for gadgets that could be awkward to signal into immediately, equivalent to good TVs or printers. The machine shows a brief code that the person enters on a Microsoft web page on one other machine, typically a smartphone, and completes authentication there. Microsoft then points entry tokens to the machine that requested entry.
That separation is beneficial, nevertheless it leaves room for abuse. Attackers can generate the code and dupe the sufferer into coming into it – all whereas Microsoft solely sees a sound authentication move. The corporate does warn customers in the mean time of sign-in by way of on-screen textual content telling them to not enter codes from sources that they don’t belief. Nonetheless, a convincing decoy is typically sufficient to get the sufferer to learn previous any warnings.
Talking of which, EvilTokens strips out most of the pink flags that folks have been taught to note over time, together with misspelled domains and pretend login pages. The login web page is actual and, from the sufferer’s perspective, all the authentication course of can seem to work as anticipated.
The assault additionally ‘muddies the waters’ in relation to safeguards offered by 2FA. Whereas the second authentication layer has by no means been extra necessary, it falls quick when the sufferer approves the improper session. In these assaults, attackers don’t subvert 2FA by means of any technical wizardry – fairly, they merely dupe the sufferer into finishing 2FA for them.
The best way to cut back the chance
Phishing safety ideas clearly can’t cease at “examine the hyperlink,” not to mention “search for typos.” These habits nonetheless assist, in fact, however they don’t maintain up in opposition to fashionable assaults, particularly people who abuse actual authentication flows.
Listed below are a number of ideas for staying protected from EvilTokens:
- Consider any surprising request for an authentication code as suspect. No doc, bill, e-mail, or one other platform ought to ask for a tool code with no clear cause. If the request arrives out of nowhere, flag it to your employer’s IT or safety crew.
- Context issues greater than the web page. Earlier than approving any sign-in request, examine which app is asking for entry, which account is concerned, and whether or not you truly began the motion. An actual Microsoft web page doesn’t mechanically make a request protected.
- Organizations ought to limit machine code move outright the place it’s not wanted. Microsoft recommends making use of Conditional Entry insurance policies to dam machine code move wherever it isn’t crucial and scope it to particular customers, gadgets, areas, or working programs.
- Look ahead to uncommon device-code authentication, unfamiliar gadgets, dangerous sign-ins, suspicious token use, and new inbox guidelines – any of those can level to hassle.
- Safety consciousness coaching must meet up with the newest tips up attackers’ sleeves. Staff ought to perceive that fashionable phishing doesn’t at all times contain typing a password right into a faux web page. Generally the attacker might ask them to enter an actual code on an actual web page – however for the improper machine.
- Staff who obtain an surprising device-code request ought to notify their firm’s IT or safety groups, who might have to evaluation sign-in logs, revoke periods, invalidate refresh tokens, take away malicious inbox guidelines, and briefly disable the compromised account.
EvilTokens is a reminder that attackers don’t at all times want to interrupt the entrance door or steal the important thing to it. Generally they solely want to speak somebody into opening it.
