EvilTokens Emerges as New Phishing-as-a-Service Platform for Microsoft Account Takeover

A new and dangerous phishing toolkit has entered the cybercrime scene. In early 2026, a Phishing-as-a-Service platform called EvilTokens began circulating in underground cybercrime communities, offering criminals a ready-to-use kit built to steal Microsoft 365 accounts.

Unlike most phishing tools that mimic Microsoft login pages, EvilTokens takes a different approach — it abuses the legitimate Microsoft device code authentication flow to quietly hand over full account access to attackers.

EvilTokens first appeared in mid-February 2026 and was quickly adopted by cybercriminals focused on Business Email Compromise (BEC) and Adversary-in-the-Middle (AitM) attacks.

The platform operates through Telegram bots and equips affiliates with phishing page templates, email harvesting tools, account reconnaissance features, a built-in webmail interface, and AI-powered automation.

The operator, known as eviltokensadmin, has announced plans to expand support to Gmail and Okta phishing pages in the near future.

Researchers at Sekoia’s Threat Detection and Research (TDR) team identified EvilTokens in March 2026 while monitoring phishing-focused cybercrime communities.

After analysing the platform’s backend code, TDR analysts confirmed that EvilTokens is the first PhaaS known to offer turnkey Microsoft device code phishing pages, and assessed with high confidence that the kit’s code was likely AI-generated.

Campaigns linked to EvilTokens have affected organisations across North America, South America, Europe, the Middle East, Asia, and Oceania.

The most impacted countries include the United States, Australia, Canada, France, India, Switzerland, and the United Arab Emirates.

Affiliates focused on employees in finance, HR, logistics, and sales — roles most vulnerable to BEC fraud. By 23 March 2026, researchers tracked over 1,000 domains hosting EvilTokens phishing pages across diverse lures including fake financial reports, meeting invites, payroll notices, and shared cloud documents from DocuSign, OneDrive, and SharePoint.

How EvilTokens Steals Microsoft Accounts

The core of EvilTokens is the abuse of Microsoft’s OAuth 2.0 Device Authorisation Grant, a legitimate flow designed for devices with limited input capabilities such as smart TVs or printers.

Normally, a device displays a short code that the user enters on a separate browser to authenticate. EvilTokens hijacks this flow by acting as the authenticating device and tricking victims into completing the sign-in on the attacker’s behalf.

The attack begins when the attacker sends a request to Microsoft’s API to generate a fresh device code. 

This code is passed to the victim through a phishing page or attachment. The victim, believing they are simply verifying access to a shared document or invoice, visits the real Microsoft login page and enters the code.

Once they complete the sign-in, the attacker’s system receives a valid access token and a refresh token, granting immediate and long-lasting access to the account. 

The access token gives attackers up to 90 minutes to read emails, pull files from OneDrive and SharePoint, and view Teams conversations. The refresh token is far more dangerous — it lasts 90 days and renews itself each time it is used, letting attackers maintain silent access without any new login prompt.

In advanced cases, EvilTokens converts these tokens into a Primary Refresh Token (PRT), enabling silent sign-on across all Microsoft 365 applications with no password or MFA required.

Phishing pages impersonate services like Adobe Acrobat Sign, DocuSign, and SharePoint, serving encrypted content via AES-GCM decryption to evade security tools.

Organisations should disable device code authentication flows for users who do not need them using Conditional Access policies in Microsoft Entra ID. Security teams should monitor sign-ins using the device code grant type, especially from unknown locations.

Employee training on device authentication is essential, since this attack succeeds only when victims are unaware of what entering a device code actually authorises.

Defenders can apply the YARA rule released by Sekoia to detect EvilTokens phishing pages and query urlscan.io and urlquery with known EvilTokens URL patterns to identify related infrastructure.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.