Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page (microsoft.com/devicelogin), which granted attackers ongoing access without stealing a password. The platform also used AI to read stolen mailboxes and draft convincing impersonation messages aimed at fraud and invoice scams.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you’re on the real microsoft.com/devicelogin page… and you’re still getting scammed. Storm-2992’s EvilTokens sends a fake invoice or RFP email, then a web page pops up a “live” device code and a big “Continue with Microsoft” button that walks you to the real Microsoft sign-in while silently handing your mailbox to them. Here’s the trap: you paste that code into microsoft.com/devicelogin, maybe even pass MFA, and EvilTokens gets OAuth tokens that keep reading your email and sending AI-written fake invoices as you, no password needed, even after a reset. If you’re ever asked to copy a device code into microsoft.com/devicelogin for an invoice, RFP, or shared file you didn’t start yourself, stop and report it to security immediately.
Microsoft says it disrupted “EvilTokens,” an AI-assisted phishing service used to trick employees into authorizing attacker access via the device-code login flow (often used for TVs/printers). Victims who entered an attacker-provided code in their browser unknowingly granted access tokens that…
Microsoft and partners disrupted “EvilTokens,” a phishing service that helped criminals break into more than 12,000 mailboxes across 10,000+ organizations. Victims were tricked into entering an authentication code on a real Microsoft sign-in page, letting attackers capture access tokens and get…
EvilTokens was a phishing-as-a-service operation that used “device code phishing” to trick employees into authorizing an attacker session on Microsoft’s real login infrastructure, often bypassing MFA without stealing passwords. After access, attackers used AI to find payment-related conversations…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service operation linked to more than 12,000 compromised Microsoft email inboxes across 10,000+ organizations. The service used AI to pick targets, impersonate trusted contacts, and steal session tokens so criminals could stay in…
Microsoft and UK police took down “EvilTokens,” an AI-powered phishing service sold on Telegram that helped criminals compromise email accounts and then rapidly find the best ways to commit fraud. The service could analyze a victim’s inbox to identify trusted relationships and financial workflows,…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
