EvilTokens Device Code Phishing: Microsoft Guidance

Introduction

Microsoft has published a deep dive into EvilTokens, a phishing-as-a-service platform that rapidly became a major threat in 2026. The campaign is notable because it abuses the legitimate device code authentication flow to capture tokens, bypass traditional MFA expectations, and maintain access to Microsoft 365 accounts.

For IT and security administrators, this is an important reminder that modern phishing increasingly targets session tokens and OAuth flows, not just usernames and passwords.

What’s new in Microsoft’s findings

Microsoft says EvilTokens:

• Compromised more than 12,000 inboxes across over 10,000 organizations worldwide
• Used AI-assisted phishing lures and inbox analysis to identify high-value targets
• Abused the device code flow to trick users into authorizing attacker-controlled sessions
• Enabled post-compromise activity such as email exfiltration, malicious inbox rules, and Microsoft Graph reconnaissance
• Supported large-scale campaigns with short-lived infrastructure and automated backend logic designed to evade detection

Microsoft also linked the development and support of the platform to Storm-2992 and said its Digital Crimes Unit helped disrupt infrastructure used by the service.

Why device code phishing is effective

Device code authentication is designed for devices like smart displays, Teams devices, and conference systems that cannot complete a normal interactive sign-in. Attackers exploit this by initiating the sign-in themselves, then convincing a user to enter the code through a phishing lure.

Because the user completes a legitimate Microsoft authentication step, the attacker can obtain access without stealing the password directly. That makes this technique especially dangerous in environments that rely heavily on MFA as a primary defense.

Impact on administrators

Organizations using Microsoft 365, Entra ID, and Defender should review whether device code flow is truly required in their environment. Industries affected by EvilTokens campaigns included financial services, healthcare, higher education, construction, and real estate, showing that the threat is broad rather than niche.

Security teams should also assume that a successful token theft may lead to:

• Persistent mailbox access
• Hidden inbox rules
• Internal reconnaissance through Microsoft Graph
• Follow-on business email compromise activity

Recommended next steps

Microsoft’s guidance is clear:

• Block device code flow wherever possible
• If required for Teams devices, scope exceptions narrowly to specific resource accounts
• Review Conditional Access configuration, including exclusions for the Device Registration Service only where needed
• Use Microsoft Defender XDR detections and hunting queries from the Microsoft report
• Strengthen mail flow rules, spoof protection, and connector configuration to reduce phishing delivery
• Train users to be cautious of requests to enter device codes outside expected sign-in scenarios

Bottom line

EvilTokens shows how attackers are operationalizing token theft at scale using AI, automation, and legitimate authentication workflows. For defenders, the priority is to reduce unnecessary device code usage, tighten Conditional Access, and improve detection for suspicious token-based activity.