Microsoft: EvilTokens device-code phishing service has compromised over 12,000 mailboxes

Microsoft has disclosed a device-code phishing operation that has seized control of more than 12,000 Microsoft 365 mailboxes at over 10,000 organizations worldwide since February 2026. According to a Microsoft report published on 22 September and summarized on dev.to, the campaign runs on a commercial phishing platform named EvilTokens, built and maintained by a threat cluster Microsoft tracks as Storm-2992.

How the attack works

EvilTokens operates as Phishing-as-a-Service, renting subscribers access to 44 ready-made lure themes. Its distinguishing trick is that it never shows the victim a counterfeit login page. Instead it abuses the OAuth 2.0 device authorization flow used by Entra ID and Microsoft 365.

The sequence runs like this: a victim receives an urgent message containing a link or a PDF/HTML attachment. The landing page, reached through multi-stage redirects hosted on services such as Vercel, Cloudflare Workers and AWS Lambda, tells the victim to copy a code and finish signing in. The victim then visits the genuine microsoft.com/devicelogin page and authenticates normally, entering a password and completing MFA, or simply confirming an already active session.

What the victim cannot see is that the code belongs to a session the attacker started. The attacker's backend is polling the Microsoft identity provider, and once the victim approves the request, it collects access and refresh tokens. The attacker never learns the password and never has to defeat MFA, because the victim completed both steps on Microsoft's own infrastructure.

What happens after compromise

With the token in hand, the attacker can read mail and query Microsoft Graph. The report describes a familiar post-compromise routine: registering new devices to obtain Primary Refresh Tokens for persistence, creating inbox rules that conceal malicious activity, bulk-reading mailbox contents, and enumerating organizational structure and permissions.

The stolen mail is then fed into AI-driven analysis to pick promising targets, with the writeup naming finance, executive management and administrative roles, feeding internal phishing and preparation for business email compromise. The dev.to summary also credits Microsoft's Digital Crimes Unit with action against the group's infrastructure, lists SpyCloud as a joint-investigation partner, and notes separate incident coverage from BleepingComputer.

What administrators should look for

Because no malware runs on the victim's machine, endpoint detection offers little; the useful evidence sits in identity and audit logs. Microsoft points to a cluster of signals:

• device-code authentications that deviate from normal patterns, followed almost immediately by a token exchange
• high volumes of Microsoft Graph read requests and enumeration of mail, permissions and organizational data
• new device registrations and refresh token use from unfamiliar devices or IP addresses
• suspicious inbox rules, mass email retrieval and external forwarding

On the defensive side, the guidance is blunt: disable the device code flow tenant-wide and re-enable it only through Conditional Access exceptions for cases that genuinely need it, such as Teams panel devices. Users should be trained to read the application name shown on the sign-in screen and to abort the process if it does not match expectations. For containment, Microsoft recommends disabling affected accounts, revoking refresh tokens and active sessions, removing unauthorized device registrations and deleting malicious inbox rules.

Why it matters

EvilTokens is a tidy demonstration of why MFA alone is no longer a sufficient control. The victim authenticates on the real Microsoft domain, passes every check, and still hands the attacker a working token. Packaging that technique as a subscription service with dozens of lure themes lowers the skill floor for anyone who wants to run it. The good news is that the fix is unusually clean: the device code flow is a setting many tenants never use, turning it off by default removes the entire attack path, and the telemetry needed to catch a compromise, from sign-in logs to Graph activity to device registrations, already exists in Entra ID for teams that go looking.