EvilTokens
A cybercriminal service that exploits the OAuth Device Code Flow to conduct phishing attacks. By directing victims through a legitimate authorization process, the service hijacks account tokens without stealing passwords, enabling unauthorized access to email accounts. The service has been taken down by Microsoft.
Timeline (last 90 days)
Microsoft seized a phishing service called EvilTokens.
The EvilTokens phishing service compromised approximately 12,000 mailboxes without stealing any passwords.
EvilTokens exploited the OAuth Device Code Flow for its attacks, rather than password leaks or brute force.
In a Device Code phishing attack, the attacker uses a legitimate device code genuinely issued by Microsoft rather than a forged short code.
Multi-factor authentication cannot block Device Code phishing attacks because the victim actively completes authentication within a legitimate flow.
Device Code attacks are more covert than AiTM (Adversary-in-The-Middle) attacks because they require no man-in-the-middle infrastructure and fully leverage Microsoft's legitimate endpoints.
All Facts (6)
EvilTokens exploited the OAuth Device Code Flow for its attacks, rather than password leaks or brute force.
50%UnverifiedIn a Device Code phishing attack, the attacker uses a legitimate device code genuinely issued by Microsoft rather than a forged short code.
50%UnverifiedMulti-factor authentication cannot block Device Code phishing attacks because the victim actively completes authentication within a legitimate flow.
50%UnverifiedDevice Code attacks are more covert than AiTM (Adversary-in-The-Middle) attacks because they require no man-in-the-middle infrastructure and fully leverage Microsoft's legitimate endpoints.
50%UnverifiedMicrosoft seized a phishing service called EvilTokens.
50%UnverifiedThe EvilTokens phishing service compromised approximately 12,000 mailboxes without stealing any passwords.
50%