Microsoft has dismantled EvilTokens, a phishing-as-a-service (PhaaS) platform that leveraged device code authentication to hijack Microsoft 365 accounts. The takedown, authorized by the U.S. District Court for the Eastern District of Virginia, involved a coalition including Microsoft’s Digital Crimes Unit, Cloudflare, Coinbase, OpenAI, SpyCloud, the Metropolitan Police Service, and others. Two individuals, aged 32 and 38, were arrested in London on September 11, 2026 in connection with the operation.
How EvilTokens Operated
EvilTokens, first seen in mid-February 2026, abused Microsoft’s OAuth 2.0 Device Authorization Grant or “device code” flow. Rather than stealing credentials or passwords, threat actors used malicious lures—emails mimicking shared files, invoices, or document-signing platforms—to coax victims into entering a code on Microsoft’s actual sign-in page. The victim completes their legitimate login and MFA prompt, believing the activity is genuine, while the attacker’s session gains valid access via refresh and access tokens.
Once inside, attackers moved to the next stages: setting up inbox rules to forward or hide messages, registering new devices, and exfiltrating sensitive data. AI tools built into EvilTokens analyzed harvested emails to map out trusted relationships, financial workflows, and best targets for impersonation. The service offered its fraud toolkit—including lures, dashboards, and automated BEC workflows—for subscription or one-time purchase, depending on the bundle.
Scope and Disruption Efforts
At its peak, EvilTokens had compromised over 12,000 email inboxes across more than 10,000 organizations globally. Victims spanned industries like finance, healthcare, education, real estate, construction, and wholesale distribution. The hardest hit regions included the U.S., Canada, the U.K., Australia, India, and France. SpyCloud alone recovered nearly 9,000 unique victim accounts from over 6,500 corporate email domains in 79 countries.
In response, Microsoft and its partners seized 50 domains directly involved in the phishing kit’s operations and disabled over 150 supporting domains. The operation also included dismantling backend infrastructures—such as phishing relay servers, malicious lures, and affiliate management panels—and disrupting payments and crypto wallets tied to the service.
EvilTokens marketed its services through Telegram channels. Different product tiers were priced from $600 to $1,500 (or $500 monthly) depending on functionality. Top-tier packages included Office 365 capture kits, SMTP senders, and B2B sender tools. Extensive templates let criminals generate convincing phishing lures, and AI modules helped automate identification of high-value targets and creation of impersonation messages.
Importantly, even after victims reset their passwords, attackers often retained access if stolen tokens and sessions weren’t revoked. Because authentication occurred through Microsoft’s legitimate site with MFA and through real lures hosted on trusted cloud services, detection was extremely difficult for both technology filters and human defenders.
The disruption of EvilTokens is being hailed as one of the most significant to date in the fight against phishing-based identity fraud. Microsoft dubbed the platform a “powerful cybercrime platform” that empowered its criminal users with toolkits that once required specialized expertise.
What This Means
Device code phishing, once a niche threat, has become a mainstream tool for attackers thanks to services like EvilTokens. Traditional defenses—password policies, MFA alerts, or suspicious URL training—prove inadequate when criminals simply make use of Microsoft’s own authentication flows. Going forward, organizations must consider tightening Conditional Access policies, disabling unused device code flows, and building visibility into session and token usage—not just credential theft. The takedown of EvilTokens offers a temporary respite, but all indicators suggest that copycats and successors are already emerging.
