This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login pages, impersonation, and job-offer workflows to get victims to authenticate or run malicious code, then searched for invoices and wire-transfer conversations to monetize access.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
EvilTokens used device-code phishing, which tricks victims into entering an authentication code on Microsoft’s real sign-in page. You get an email or website saying, 'Go to Microsoft, enter this code.' The page is 100% real, but the sign-in wasn’t started by you. Entering that code hands over access that can survive a password reset. At the same time, WaterPlum ran fake coding interviews on LinkedIn, posing as recruiters for AI, crypto, and NFT companies, pushing developers to run malicious npm packages and booby-trapped VS Code projects. Aha moment: if you didn’t start the login or the interview task, don’t trust it. Your move: stop, don’t enter the code or run the project, and report it to Security immediately.
EvilTokens was a phishing-as-a-service operation that used “device code phishing” to trick employees into authorizing an attacker session on Microsoft’s real login infrastructure, often bypassing MFA without stealing passwords. After access, attackers used AI to find payment-related conversations…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service operation linked to more than 12,000 compromised Microsoft email inboxes across 10,000+ organizations. The service used AI to pick targets, impersonate trusted contacts, and steal session tokens so criminals could stay in…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
Microsoft says it disrupted “EvilTokens,” an AI-assisted phishing service used to trick employees into authorizing attacker access via the device-code login flow (often used for TVs/printers). Victims who entered an attacker-provided code in their browser unknowingly granted access tokens that…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
