A phishing equipment subverting Microsoft’s reliable authentication circulate lets attackers break into accounts with out stealing passwords or creating pretend login pages
15 Jun 2026
•
,
5 min. learn
A lot has been written about how the times of phishing emails laden with damaged grammar and crude design are numbered, largely because of AI. In the meantime, EvilTokens affords a considerably completely different instance of how far the phishing craft has moved.
EvilTokens is a phishing-as-a-service (PhaaS) equipment constructed to compromise Microsoft 365 accounts by abusing the OAuth 2.0 system authorization grant circulate. As assaults that use the equipment depend on system code phishing, they sidestep the necessity for convincing replicas of real login pages the place the victims would hand over their passwords. As a substitute, attackers get the sufferer to finish a reliable authentication course of – together with two-factor authentication (2FA) – on an actual Microsoft login web page.
The toolkit has been marketed through Telegram channels and noticed in energetic assaults since a minimum of February 2026. As documented by Sekoia and others, the equipment seems to have been rapidly adopted by cybercriminals and deployed in quite a few account takeover and enterprise electronic mail compromise (BEC) assaults, together with for a marketing campaign focusing on greater than 340 organizations in a number of nations in March 2026. Microsoft itself has additionally described an AI-enabled marketing campaign that used dynamic device-code era and bespoke lures to extend the success charge of EvilTokens assaults.
The interior workings of EvilTokens
Right here’s a quick overview of how assaults leveraging EvilTokens unfold:
- The assault itself is preceded by ‘reconnaissance’ the place the ne’er-do-wells first confirm that the goal account is energetic. Microsoft has seen this reconnaissance run 10 to fifteen days forward of the particular phishing try.
- The sufferer receives an electronic mail or message that’s typically dressed up as an bill, shared doc, calendar invite, or SharePoint entry request. The lure entails a decoy web page impersonating a trusted model or service, together with easy wording equivalent to “Confirm to view” or “Signature required.”
- When the sufferer clicks by means of, the web page requests a tool code from Microsoft. The code is legitimate just for quarter-hour, therefore time and timing are of the essence right here. The web page exhibits the sufferer the code alongside and factors them to Microsoft’s real microsoft.com/devicelogin login portal. The catch is that the code belongs to the attacker’s session, therefore the sufferer unknowingly authorizes the attacker’s system, not their very own.
- Seeing a sound sign-in, Microsoft points entry and refresh tokens to the session opened by the attacker. As soon as inside, the criminals can entry company electronic mail, information, Groups, SharePoint, OneDrive, and different Microsoft 365 assets and exfiltrate information or put together BEC assaults, which is why finance, HR, logistics, and gross sales accounts draw a lot of the attackers’ curiosity.
What makes EvilTokens harmful
The OAuth system code circulate was designed for units which may be awkward to signal into instantly, equivalent to good TVs or printers. The system shows a brief code that the person enters on a Microsoft web page on one other system, typically a smartphone, and completes authentication there. Microsoft then points entry tokens to the system that requested entry.
That separation is helpful, nevertheless it leaves room for abuse. Attackers can generate the code and dupe the sufferer into coming into it – all whereas Microsoft solely sees a sound authentication circulate. The corporate does warn customers for the time being of sign-in through on-screen textual content telling them to not enter codes from sources that they don’t belief. Nonetheless, a convincing decoy is usually sufficient to get the sufferer to learn previous any warnings.
Talking of which, EvilTokens strips out most of the pink flags that folks have been taught to note over time, together with misspelled domains and faux login pages. The login web page is actual and, from the sufferer’s standpoint, your entire authentication course of can seem to work as anticipated.
The assault additionally ‘muddies the waters’ in relation to safeguards offered by 2FA. Whereas the second authentication layer has by no means been extra vital, it falls quick when the sufferer approves the unsuitable session. In these assaults, attackers don’t subvert 2FA by means of any technical wizardry – relatively, they merely dupe the sufferer into finishing 2FA for them.
How one can scale back the chance
Phishing safety ideas clearly can’t cease at “verify the hyperlink,” not to mention “search for typos.” These habits nonetheless assist, in fact, however they don’t maintain up towards trendy assaults, particularly those who abuse actual authentication flows.
Listed below are just a few ideas for staying protected from EvilTokens:
- Consider any surprising request for an authentication code as suspect. No doc, bill, electronic mail, or one other platform ought to ask for a tool code with out a clear purpose. If the request arrives out of nowhere, flag it to your employer’s IT or safety staff.
- Context issues greater than the web page. Earlier than approving any sign-in request, verify which app is asking for entry, which account is concerned, and whether or not you really began the motion. An actual Microsoft web page doesn’t mechanically make a request protected.
- Organizations ought to limit system code circulate outright the place it’s not wanted. Microsoft recommends making use of Conditional Entry insurance policies to dam system code circulate wherever it isn’t obligatory and scope it to particular customers, units, places, or working methods.
- Look ahead to uncommon device-code authentication, unfamiliar units, dangerous sign-ins, suspicious token use, and new inbox guidelines – any of those can level to hassle.
- Safety consciousness coaching must meet up with the most recent tips up attackers’ sleeves. Workers ought to perceive that trendy phishing doesn’t at all times contain typing a password right into a pretend web page. Generally the attacker may ask them to enter an actual code on an actual web page – however for the unsuitable system.
- Workers who obtain an surprising device-code request ought to notify their firm’s IT or safety groups, who might have to assessment sign-in logs, revoke periods, invalidate refresh tokens, take away malicious inbox guidelines, and briefly disable the compromised account.
EvilTokens is a reminder that attackers don’t at all times want to interrupt the entrance door or steal the important thing to it. Generally they solely want to speak somebody into opening it.
