Unmasking EvilTokens: Getting to the root of device code phishing

The EvilTokens platform emerged in February 2026 as a Phishing-as-a-Service (PhaaS) platform leveraging Artificial Intelligence to tailor phishing lures and analyze compromised inboxes for high-value targets. This infrastructure facilitated sophisticated Business Email Compromise (BEC) campaigns affecting over 12,000 inboxes across more than 10,000 organizations globally. The platform enabled threat actors to abuse device code authentication flows to steal tokens, facilitating email exfiltration and persistence via malicious inbox rules or granting new device access. Attackers used AI assistants to sift through mailbox activity and engineer phishing messages based on accessible content, alongside conducting Microsoft Graph reconnaissance for organizational mapping.
The platform utilized a multi-stage delivery pipeline to evade security controls, employing deceptive emails with 44 themes, including invoice and RFP formats, leading targets to malicious URLs and attachments. Delivery mechanisms relied on leveraging cloud infrastructure like Cloudflare Workers and AWS Lambda for redirection, blending traffic with legitimate enterprise cloud services. Post-compromise activities involved using stolen tokens for internal communication, identifying high-value targets through AI analysis of email content, and exfiltrating sensitive financial data by manipulating inbox rules.
Defense against these threats requires a layered strategy combining technical controls and user awareness. Mitigation involves blocking device code flow where possible, educating users on phishing cues, configuring anti-phishing policies, enabling Safe Links, and implementing robust identity security measures such as sign-in risk policies and multi-factor authentication (MFA). The framework emphasizes continuous monitoring, threat intelligence integration, and leveraging tools like Microsoft Defender XDR and Security Copilot for detection and response.

* EvilTokens emerged in February 2026.
* The platform provided AI capabilities for tailoring phishing lures and analyzing compromised inboxes.
* The platform facilitated Business Email Compromise (BEC) campaigns affecting over 12,000 inboxes in over 10,000 organizations.
* Threat actors utilized device code authentication flows to steal tokens and compromise accounts at scale via AI-driven infrastructure.
* The toolkit included prebuilt phishing templates and landing pages with an AI assistant.
* Stolen tokens enabled email exfiltration and persistence through malicious inbox rules or granting new device access.
* Microsoft tracks the threat actor behind EvilTokens as Storm-2992.
* The delivery pipeline used deceptive emails featuring 44 themes, such as invoices and RFPs.
* Infrastructure relied on abuse of Cloudflare Workers, Bunny, and AWS Lambda for evasion.
* Post-compromise activities included using AI to sift mailbox activity and conduct Microsoft Graph reconnaissance.
* Mitigation includes blocking device code flow, educating users, configuring anti-phishing policies, and implementing sign-in risk policies.

The narrative presents a clear evolution from traditional credential theft to sophisticated session hijacking via legitimate authentication flows like device code, amplified by generative AI. The core pattern involves weaponizing legitimate, complex workflows (device code) that are designed for security assurance, effectively decoupling the authorization context from the initial session, which is then exploited for token acquisition and persistence. This shifts the attack focus from easily detectable credential theft to exploiting the trust inherent in multi-factor authentication systems and device management protocols.
The defense mechanism described emphasizes a necessary shift toward continuous, contextual verification rather than static perimeter defense. The suggestion to leverage behavioral analysis through tools like Microsoft Defender XDR and Security Copilot highlights the realization that threats move beyond signature-based blocking into the realm of anomalous identity and behavior tracking within the environment. However, the threat actor's ability to automate reconnaissance via Microsoft Graph post-compromise underscores a structural weakness in how organizational identity data is surfaced and exposed once an initial foothold is established.
The implication for agency lies in the speed differential: threat actors leverage AI to accelerate research and exploitation, while defenders are tasked with building layered, adaptive detection systems capable of monitoring subtle shifts in token usage and inbox behavior across disparate systems. The question arises whether the industry's focus remains on securing the authentication handshake itself, or if the systemic risk is now embedded within the post-authentication data flow that the infrastructure controls. How does dependence on platform-specific AI tools for defense influence the ability of organizations to maintain truly sovereign control over their identity lifecycle?