Microsoft says it disrupted “EvilTokens,” an AI-assisted phishing service used to trick employees into authorizing attacker access via the device-code login flow (often used for TVs/printers). Victims who entered an attacker-provided code in their browser unknowingly granted access tokens that could allow ongoing access to email accounts, without the attacker needing passwords.
EvilTokens targeted a legitimate feature called device code authentication, the process used to sign in on devices without a keyboard, such as TVs or printers. Normally, a user starts this flow themselves and enters a short code shown on their device into a browser. EvilTokens flipped this: the attacker initiated the authentication flow and sent the code to the victim through a phishing lure. If the victim entered that code in their own browser, they unknowingly completed the attacker's sign-in and handed over an access token, not a password.
This technique succeeded because it did not require stealing credentials in the traditional sense. Victims were giving the attacker access to their account without handing over passwords, which meant standard password hygiene and even some password-based defenses would not have stopped it. The attack also leaned on AI to generate phishing emails customized for specific targets, increasing the credibility of the lure and the odds that a busy employee would act quickly.
Since EvilTokens targeted all employees, executives, finance, HR, and anyone with access to sensitive email threads, no single department can assume it is not a target.
Organizations should reinforce a simple rule: only enter a device code that you personally generated while signing in on a device you recognize. Any code received unexpectedly, via email or otherwise, should be treated as suspicious and reported. It also helps to remind staff that passwordless authentication does not mean risk-free authentication, since attackers may specifically aim to steal access tokens instead of passwords. Given that EvilTokens used AI to tailor messages and mine compromised inboxes for valuable data, awareness training should emphasize that personalization and polish are no longer reliable signs that a message is legitimate. Combining this awareness with monitoring for unusual device sign-in attempts can help catch this technique before an account is fully compromised.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is an attack where a criminal initiates a legitimate device sign-in flow and tricks a victim into entering the attacker's short code into their own browser, which grants the attacker access to the victim's account.
No. The service was designed to obtain access tokens that could provide persistent access to email accounts without the attacker ever needing a password.
Microsoft says EvilTokens was used to compromise more than 12,000 email accounts at over 10,000 organizations.
EvilTokens used AI to generate phishing emails customized for specific targets and to help attackers analyze compromised inboxes for valuable data after access was gained.
Imagine losing your email without ever typing your password. That’s the EvilTokens trick. EvilTokens abused Microsoft’s device-code login, the one TVs and printers use. Criminals start the login, email you a short code, and when you type it into your browser, you actually approve their session and hand over an access token to your email. Here’s the catch: you never started that sign-in. No TV, no printer, nothing. Yet the email feels weirdly tailored because EvilTokens used AI to customize the message and even pick who to impersonate from real inboxes. Your move: only enter a Microsoft device code you just saw appear on a device you’re actually setting up. If an email tells you the code, stop and report it.
Microsoft and partners disrupted “EvilTokens,” a phishing service that helped criminals break into more than 12,000 mailboxes across 10,000+ organizations. Victims were tricked into entering an authentication code on a real Microsoft sign-in page, letting attackers capture access tokens and get…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
EvilTokens was a phishing-as-a-service operation that used “device code phishing” to trick employees into authorizing an attacker session on Microsoft’s real login infrastructure, often bypassing MFA without stealing passwords. After access, attackers used AI to find payment-related conversations…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service operation linked to more than 12,000 compromised Microsoft email inboxes across 10,000+ organizations. The service used AI to pick targets, impersonate trusted contacts, and steal session tokens so criminals could stay in…
Microsoft and UK police took down “EvilTokens,” an AI-powered phishing service sold on Telegram that helped criminals compromise email accounts and then rapidly find the best ways to commit fraud. The service could analyze a victim’s inbox to identify trusted relationships and financial workflows,…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
