Microsoft disrupted “EvilTokens,” a subscription cybercrime service that stole Microsoft account access using device-code phishing and then used AI-style automation to rapidly mine victims’ inboxes for payment and org-chart details. The goal was to quickly craft believable payment-fraud messages that appeared to come from trusted contacts, enabling invoice/bank-change scams and other business email compromise (BEC) workflows.
EvilTokens was a subscription cybercrime service marketed on Telegram that offered phishing and post-compromise automation to its customers. Its first stage relied on device-code phishing: victims received phishing emails or clicked malicious attachments that led to pages running scripts communicating with Microsoft Entra in real time. These pages generated device codes and instructed victims to enter them at Microsoft's legitimate device-login site, an OAuth flow originally meant for devices with limited input options like televisions. Entering the code unknowingly authorized an attacker-controlled device, handing over account access.
Once inside a mailbox, an AI-style chatbot component analyzed the inbox at scale, identifying trusted contacts, payment approvers, reporting lines, and vendor or customer relationships. This let attackers quickly craft believable messages requesting payments or changed banking instructions, impersonating people the recipient already trusted.
The scheme worked because it exploited a legitimate, expected sign-in mechanism rather than an obviously fake login page, making the initial phishing step harder to spot. Once access was gained, the speed and scale of the automated inbox analysis meant attackers could move from compromise to convincing fraud attempts very quickly, before defenders or victims noticed anything unusual. Because the follow-on messages appeared to come from real, trusted contacts inside the victim's own mailbox history, they carried built-in credibility that generic phishing lacks.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It abuses a legitimate OAuth sign-in method meant for devices with limited input, tricking victims into entering an attacker-generated code at Microsoft's real device-login site, which authorizes the attacker's device instead.
An AI-style chatbot scanned compromised inboxes to identify trusted contacts, payment approvers, and reporting lines, then helped draft believable messages to request payments or change banking instructions.
The scenarios point to all employees for the initial device-code sign-in lure, and finance, accounts payable, and payment approvers for the follow-on payment fraud attempts.
Treat unexpected device-code sign-in prompts as high risk, respond quickly once an inbox compromise is suspected, and require out-of-band verification for any request to change payment details or redirect funds.
Imagine this: you enter a legit Microsoft device code… and someone else gets into your inbox. That’s EvilTokens. A Telegram subscription service that emails you a “Microsoft sign-in” link, then tells you to paste a device code into the real device-login site to “finish” sign-in. Once you do, their AI chatbot tears through your mailbox for org charts and payment approvers, then drafts super-believable emails like, “Hi, we’ve updated our bank details, please send today’s payment here instead.” Your move: if you ever see a device-code sign-in you didn’t start, or an email asking to change payment or bank details, stop and call the person on a known number before doing anything.
EvilTokens was a phishing-as-a-service operation that used “device code phishing” to trick employees into authorizing an attacker session on Microsoft’s real login infrastructure, often bypassing MFA without stealing passwords. After access, attackers used AI to find payment-related conversations…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
Microsoft says it disrupted the “EvilTokens” phishing-as-a-service platform, which it links to compromises of over 12,000 inboxes across more than 10,000 organizations. The service used AI to tailor phishing emails to a victim’s role and to analyze compromised inboxes to identify trusted…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
