Full Report
EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption of EvilTokens infrastructure and operations. The post Unmasking EvilTokens: Getting to the root of device code phishing appeared first on Microsoft Security Blog.
Analysis Summary
# Tool/Technique: EvilTokens
## Overview
EvilTokens is a sophisticated Phishing-as-a-Service (PhaaS) platform specifically designed to facilitate **Device Code Phishing** attacks. Unlike traditional phishing that targets credentials, EvilTokens focuses on bypassing Multi-Factor Authentication (MFA) by tricking users into authenticating an attacker-controlled session through the OAuth 2.0 device authorization flow, ultimately leading to token theft and account takeover.
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) / Attack Tool
- **Platform:** Cloud-based identity providers (primarily Microsoft Entra ID / Microsoft 365)
- **Capabilities:** AI-assisted lure generation, automated infrastructure deployment, Device Code flow exploitation, session token theft.
- **First Seen:** Actively tracked throughout 2024; disruption operations reported in late 2024/early 2025.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1528 - Steal Application Access Token]
- **[TA0004 - Privilege Escalation]**
- [T1548.003 - Abuse Authorization Mechanism: Device Code Flow]
- **[TA0007 - Discovery]**
- [T1087.004 - Account Discovery: Cloud Account]
## Functionality
### Core Capabilities
- **Device Code Flow Exploitation:** Leverages the OAuth 2.0 flow intended for devices without browsers (like smart TVs). The tool generates a code and prompts the victim to enter it at a legitimate Microsoft URL (`microsoft.com/devicelogin`).
- **Token Theft:** Once the victim enters the code and authenticates, EvilTokens captures the resulting access and refresh tokens, granting the attacker persistent access without needing the victim's password.
- **MFA Bypass:** Because the victim performs the MFA on their own trusted device during the legitimate login process, the attacker receives a fully authenticated session token that bypasses traditional MFA protections.
### Advanced Features
- **AI-Assisted Lures:** Uses generative AI to create highly convincing, personalized phishing emails and landing pages to increase victim click-through rates.
- **Automated Infrastructure:** Utilizes legitimate Platform-as-a-Service (PaaS) providers (such as Railway.app) to host attack infrastructure, making the traffic appear legitimate and harder to block.
- **Reverse Proxy Capabilities:** Acts as a man-in-the-middle to intercept real-time communication between the user and the identity provider.
## Indicators of Compromise
- **File Hashes:** N/A (Tool is primarily cloud-based/PhaaS).
- **File Names:** N/A.
- **Network Indicators:**
- `microsoft-login[.]com` (Defanged)
- `devicelogin-microsoft[.]com` (Defanged)
- `railway[.]app` (Subdomains used for C2/hosting)
- `portal-azure[.]com` (Defanged)
- **Behavioral Indicators:**
- Unusual `UserAgent` strings during the Device Code flow.
- Sign-in logs showing `Device Code Flow` from unexpected geographic locations.
- Successive logins where the IP address for the device code request differs significantly from the IP address of the device code redemption.
## Associated Threat Actors
- Primarily used by financially motivated cybercriminals and various affiliates purchasing the PhaaS subscription.
- Linked to broad campaigns abusing Railway.com infrastructure (as noted by Huntress research).
## Detection Methods
- **Behavioral detection:** Monitor Microsoft Entra ID (Azure AD) sign-in logs for `Authentication Protocol: Device Code`.
- **Identity Protection:** Flag "Impossible Travel" alerts associated with successful OAuth token exchanges.
- **KQL Queries:**
- `SigninLogs | where AuthenticationProtocol == "deviceCode"`
- Monitoring `EmailEvents` for links pointing to known PaaS hosting providers used by the platform.
## Mitigation Strategies
- **Conditional Access Policies:** Restrict the use of Device Code Flow to specific, managed devices or block it entirely if not required by the business.
- **Phishing-Resistant MFA:** Transition to FIDO2-based authentication or certificate-based authentication which is not susceptible to device code interception.
- **User Training:** Educate users never to enter a code into `microsoft.com/devicelogin` unless they personally initiated a login on a secondary device (like a smart TV or printer).
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM):** Similar goal of token theft, but typically uses a transparent proxy rather than the device code flow.
- **EvilProxy / NakedPages:** Other PhaaS platforms that focus on AiTM techniques.
- **OAuth App Consent Phishing:** A related technique targeting application permissions rather than device codes.