A financially motivated actor (“Doubloon Dredger”) abused legitimate Notion sharing notifications to trick employees into opening a PDF and completing a Microsoft device-code login flow. This allowed the attacker to harvest authentication tokens and access victim accounts without needing the password. Researchers also observed layered phishing infrastructure and links to phishing-as-a-service platforms like EvilTokens and Tycoon2FA.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a Notion email: your CFO just shared a document you need to review and sign. Looks totally legit, right? But this Doubloon Dredger scam chains three steps: Notion alert, then a PDF with a big 'Review and Sign' button, then an Adobe-looking page that hands you a Microsoft device code. Here’s the twist: they tell you, 'Enter this code on Microsoft’s device-code page.' The Microsoft site is real, but entering that code hands EvilTokens and Tycoon2FA a token to your account, no password needed. If a document you weren’t expecting leads to a PDF and then tells you to enter a code on Microsoft, stop. Message the executive directly on Teams or email and confirm before you touch any code.
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
The article describes how real-world attackers are shifting common breach activity into the web browser, including phishing that steals live sessions, fake “copy/paste to fix” prompts (ClickFix), and OAuth consent/device-code tricks. It highlights how these browser-based lures can bypass MFA and…
The article describes how real-world phishing and social engineering are evolving to bypass the checks employees are trained to use (bad grammar, suspicious URLs, obvious fake login pages). It highlights specific, observed attack workflows including QR-code “device hop” phishing, OAuth token theft…
Microsoft says it disrupted “EvilTokens,” an AI-assisted phishing service used to trick employees into authorizing attacker access via the device-code login flow (often used for TVs/printers). Victims who entered an attacker-provided code in their browser unknowingly granted access tokens that…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
