EvilTokens Surges: New Device Code Phishing Threat to M365

Security researchers have identified a significant escalation in device code phishing attacks, primarily targeting Microsoft 365 users. This surge is directly attributed to the emergence of EvilTokens, an advanced and specialized phishing toolkit now widely available as-a-service via Telegram. Device code phishing is an insidious attack vector where malicious actors cunningly trick users into initiating a legitimate authentication process, only to intercept and steal their valuable access and refresh tokens during this seemingly benign interaction.

The ‘as-a-service’ model offered by EvilTokens significantly lowers the barrier to entry for cybercriminals, empowering even less technically sophisticated attackers to execute highly effective phishing campaigns. By leveraging genuine Microsoft authentication flows, these attacks appear more credible to unsuspecting users, making detection challenging and increasing the likelihood of successful token theft. The primary benefit for attackers is the acquisition of these tokens, which grant persistent, unauthorized access to a victim’s Microsoft 365 account without needing to repeatedly compromise passwords or bypass traditional multi-factor authentication (MFA) mechanisms.

For Microsoft 365 users and their organizations, the risks associated with device code phishing are severe. Stolen access and refresh tokens can lead directly to full account takeover, enabling attackers to access sensitive corporate data, emails, cloud storage, and other critical resources within the Microsoft 365 ecosystem. This unauthorized access can facilitate data breaches, intellectual property theft, financial fraud, and further lateral movement within an organization’s network. Crucially, the nature of token theft means that even robust MFA implementations can be circumvented if the initial token acquisition is successful, highlighting the advanced threat posed by toolkits like EvilTokens.

The widespread availability and specialized nature of EvilTokens represent a growing and sophisticated threat landscape for Microsoft 365 environments. Organizations and users must remain vigilant and implement advanced security measures beyond traditional password protection and basic MFA to mitigate the risks posed by these evolving device code phishing tactics.

(Source: https://www.helpnetsecurity.com/2026/03/31/eviltokens-phishing-microsoft-365/)