Full Report
Device code phishing doesn't need stolen passwords or malware—just a legitimate auth flow. Learn how EvilTokens weaponized AI to run this attack across 344 organizations.
Analysis Summary
# Tool/Technique: EvilTokens
## Overview
EvilTokens is a sophisticated Phishing-as-a-Service (PhaaS) platform sold via Telegram that weaponizes the OAuth 2.0 Device Authorization Grant flow. Unlike traditional phishing that targets credentials, EvilTokens focuses on "session borrowing." It leverages AI to generate highly personalized lures and automate post-compromise activities like wire fraud, allowing attackers to bypass Multi-Factor Authentication (MFA) by exploiting legitimate Microsoft authentication processes.
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) / Attack Framework
- **Platform:** Microsoft 365 (M365), Azure AD/Entra ID
- **Capabilities:** AI-generated phishing lures, automated token capture, MFA bypass (via session theft), post-compromise automation (wire fraud drafting).
- **First Seen:** February 19, 2026 (Large scale campaign March 2, 2026)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1528 - Steal Application Access Token]
- **[TA0005 - Defense Evasion]**
- [T1550.004 - Use Alternate Authentication Material: Web Session Cookie]
- [T1078 - Valid Accounts]
- **[TA0007 - Discovery]**
- [T1087.003 - Account Discovery: Email Account]
## Functionality
### Core Capabilities
- **Device Code Exploitation:** Initiates a legitimate Microsoft device code flow. The victim is directed to `microsoft[.]com/devicelogin` to enter a code, which grants the attacker a primary refresh token (PRT) once the victim authenticates.
- **MFA Bypass:** Because the user authenticates via a legitimate Microsoft prompt on their own trusted device, the MFA requirement is satisfied for the session the attacker initiated.
- **Infrastructure Abstraction:** Utilizes legitimate PaaS providers like **Railway** to host attack infrastructure, making IP-based blocking difficult.
### Advanced Features
- **AI-Driven Personalization:** Uses AI to generate role-specific lures and drafts wire fraud emails by mimicking the victim’s writing style (tone/voice) immediately after compromise.
- **Dynamic Code Generation:** Rapidly generates the necessary authentication codes to minimize the timing window where a link might expire.
- **Phishing-as-a-Service Model:** Sold for approximately $1,500 USD plus a $500 monthly maintenance fee, lowering the barrier to entry for low-skill actors.
## Indicators of Compromise
- **File Hashes:** N/A (Tool is service-based; no local malware payload).
- **File Names:** N/A.
- **Registry Keys:** N/A.
- **Network Indicators:**
- `railway[.]app` (Legitimate PaaS used for hosting C2/Phish infrastructure).
- `microsoft[.]com/devicelogin` (Legitimate URL used in an unauthorized context).
- **Behavioral Indicators:**
- Logins originating from Railway PaaS IP addresses.
- Multiple login events across disparate organizations originating from the same cloud-hosting IP.
- "DeviceCode" authentication method appearing in Entra ID sign-in logs for users who do not typically use non-browser based devices (like Smart TVs or CLI tools).
## Associated Threat Actors
- Distributed via Telegram; specific named groups are not identified, but it is utilized by diverse "budget" cybercriminals and sophisticated PhaaS subscribers.
## Detection Methods
- **Behavioral Detection:** Monitor Microsoft Entra ID (Azure AD) Sign-in logs for the `Authentication Protocol: Device Code` field. Flag instances where this occurs on accounts that do not have a business use case for it.
- **Identity Security Posture Management (ISPM):** Identify anomalous "Impossible Travel" alerts coinciding with device code grants.
- **Log Analysis:** Look for unusual User-Agent strings or Source IP addresses associated with cloud hosting providers (AWS, Azure, Railway) during the authentication phase.
## Mitigation Strategies
- **Conditional Access Policies:** Explicitly disable or restrict the Device Code Flow (OAuth 2.0 Device Authorization Grant) for all users except those who specifically require it.
- **Token Lifetime Policies:** Shorten the lifespan of session tokens to reduce the window of opportunity for attackers.
- **User Education:** Train users to be suspicious of any request asking them to enter a code at `microsoft[.]com/devicelogin` unless they are intentionally signing into a secondary device like a printer or smart TV.
- **Managed Detection and Response (MDR):** Employ identity-centric monitoring to catch session anomalies that bypass traditional email filters.
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM):** Similar goal (session theft) but uses a proxy instead of a device code.
- **EvilProxy / Lure:** Other PhaaS frameworks targeting session tokens.
- **Railway PaaS:** Frequently abused for hosting phishing backends.