EvilTokens was a phishing-as-a-service operation that used “device code phishing” to trick employees into authorizing an attacker session on Microsoft’s real login infrastructure, often bypassing MFA without stealing passwords. After access, attackers used AI to find payment-related conversations and then impersonated finance staff or vendors in existing threads to redirect payments, including cryptocurrency. Microsoft, Coinbase, and partners disrupted the infrastructure and an alleged operator was arrested in London.
EvilTokens was a phishing-as-a-service kit, attributed by Microsoft to a group called Storm-2992 and sold on Telegram. Victims received AI-generated emails styled as invoices, shared documents, or voicemail notifications, each containing a malicious link. Clicking the link led to a fake Microsoft or DocuSign page that displayed a code and instructed the victim to enter it on Microsoft's real login site to verify their identity. That single step authorized the attacker's session rather than a legitimate device request.
This is device code phishing: instead of a real device requesting access, the attacker initiates the login flow and hands the victim a code through a phishing lure. Because the victim completes the final step on Microsoft's own, legitimate infrastructure, MFA was bypassed entirely and no password was ever exposed. The attacker's access tokens also survived password resets, making the compromise harder to remediate once discovered.
Once inside a mailbox, attackers:
This turned a single credential-free login into a business email compromise operation targeting finance, accounts payable, procurement, and executive staff.
Organizations and employees can reduce exposure by treating any unsolicited device code as an immediate red flag and reporting it rather than acting on it. Because this scam abuses a legitimate Microsoft sign-in flow, technical MFA alone is not a reliable backstop, so staff need to recognize the device code pattern itself. For payment requests, verify any change to payment details through a phone call to a known number rather than by replying in the same email thread. Microsoft's Digital Crimes Unit seized 50 websites and disabled over 175 domains tied to this operation, and UK police arrested an alleged operator, but similar phishing-as-a-service kits are likely to persist, making user awareness of device code abuse and payment thread hijacking an ongoing priority.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a technique where an attacker starts a Microsoft device code sign-in flow and tricks a victim into entering that code on Microsoft's real login page, which authorizes the attacker's session instead of the victim's device.
No. Because the authentication happens on Microsoft's legitimate infrastructure, MFA was bypassed entirely in the EvilTokens campaign, and attacker access tokens survived password resets.
After compromising mailboxes, attackers registered devices in Entra ID, created hidden inbox rules, and impersonated finance staff, vendors, or executives inside live payment threads to redirect payments, including cryptocurrency.
The operation compromised more than 12,000 inboxes across over 10,000 organizations before Microsoft's Digital Crimes Unit seized 50 websites and disabled over 175 domains tied to it.
Twelve thousand inboxes got hit by this: a fake invoice email that ends up authorizing an attacker on Microsoft’s real login page. You click, land on a fake Microsoft or DocuSign page, and it shows a device code. It tells you: ‘Go to microsoft.com/devicelogin and enter this code to verify your identity.’ When you do, you’ve just authorized EvilTokens’ session, no password stolen, MFA bypassed. From there, Storm-2992 used EvilTokens to sit in real mailboxes, register devices in Entra ID, hide inbox rules, then jump into live payment threads pretending to be finance or a vendor and quietly swap bank or crypto details. Your move: if you ever see a device code you didn’t request, or a payment detail change by email, stop and report it to Security, do not complete it.
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
Microsoft says it disrupted “EvilTokens,” an AI-assisted phishing service used to trick employees into authorizing attacker access via the device-code login flow (often used for TVs/printers). Victims who entered an attacker-provided code in their browser unknowingly granted access tokens that…
Microsoft and partners disrupted “EvilTokens,” a phishing service that helped criminals break into more than 12,000 mailboxes across 10,000+ organizations. Victims were tricked into entering an authentication code on a real Microsoft sign-in page, letting attackers capture access tokens and get…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service operation linked to more than 12,000 compromised Microsoft email inboxes across 10,000+ organizations. The service used AI to pick targets, impersonate trusted contacts, and steal session tokens so criminals could stay in…
Microsoft and UK police took down “EvilTokens,” an AI-powered phishing service sold on Telegram that helped criminals compromise email accounts and then rapidly find the best ways to commit fraud. The service could analyze a victim’s inbox to identify trusted relationships and financial workflows,…
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
