EvilTokens is a real phishing-as-a-service operation that abuses Microsoft’s device-code sign-in process to persuade victims to grant access to their Microsoft 365 accounts. After access is granted, its AI analyzes inboxes and business relationships, identifies people involved in payments, and drafts fraud messages based on real conversations.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
“Authorize this device to access your Microsoft account.” Didn’t start that sign-in? EvilTokens exploits Microsoft’s real OAuth device-code flow. Approve a device you don’t recognize, and someone else can access your Microsoft 365 mailbox, without your password. Here’s the twist: its AI reads real conversations, finds who handles payments, then drafts an invoice email that sounds like your trusted supplier. The giveaway isn’t a bad password page. It’s a device request you never started. Don’t approve it.
This article describes real-world “device code phishing” campaigns where victims are tricked into approving an OAuth device login, granting attackers access without stealing passwords. It highlights rapid criminal adoption via phishing-as-a-service kits and notes heavy targeting of Microsoft…
Huntress reports attackers are increasingly installing legitimate remote monitoring and management (RMM) tools after a phishing click, giving them persistent remote control that can blend in with normal IT activity. The article also describes common identity-focused schemes like hidden mailbox…
The article describes how real-world phishing and social engineering are evolving to bypass the checks employees are trained to use (bad grammar, suspicious URLs, obvious fake login pages). It highlights specific, observed attack workflows including QR-code “device hop” phishing, OAuth token theft…
Microsoft says it disrupted “EvilTokens,” an AI-powered phishing-as-a-service operation used to break into email accounts at scale. The service automated device-code login phishing end-to-end, helping criminals steal authentication tokens and enable business email compromise across more than 10,000…
Microsoft and partners disrupted “EvilTokens,” a phishing service that helped criminals break into more than 12,000 mailboxes across 10,000+ organizations. Victims were tricked into entering an authentication code on a real Microsoft sign-in page, letting attackers capture access tokens and get…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
