A phishing assault that doesn’t steal your password

A phishing equipment subverting Microsoft’s professional authentication move lets attackers break into accounts with out stealing passwords or creating faux login pages

15 Jun 2026
 • 
,
5 min. learn

A lot has been written about how the times of phishing emails laden with damaged grammar and crude design are numbered, largely because of AI. In the meantime, EvilTokens affords a considerably totally different instance of how far the phishing craft has moved.

EvilTokens is a phishing-as-a-service (PhaaS) equipment constructed to compromise Microsoft 365 accounts by abusing the OAuth 2.0 system authorization grant move. As assaults that use the equipment depend on system code phishing, they sidestep the necessity for convincing replicas of real login pages the place the victims would hand over their passwords. As a substitute, attackers get the sufferer to finish a professional authentication course of – together with two-factor authentication (2FA) – on an actual Microsoft login web page.

The toolkit has been marketed through Telegram channels and noticed in energetic assaults since at the very least February 2026. As documented by Sekoia and others, the equipment seems to have been shortly adopted by cybercriminals and deployed in a lot of account takeover and enterprise e-mail compromise (BEC) assaults, together with for a marketing campaign concentrating on greater than 340 organizations in a number of international locations in March 2026. Microsoft itself has additionally described an AI-enabled marketing campaign that used dynamic device-code era and bespoke lures to extend the success charge of EvilTokens assaults.

The interior workings of EvilTokens

Right here’s a short overview of how assaults leveraging EvilTokens unfold:

• The assault itself is preceded by ‘reconnaissance’ the place the ne’er-do-wells first confirm that the goal account is energetic. Microsoft has seen this reconnaissance run 10 to fifteen days forward of the particular phishing try.
• The sufferer receives an e-mail or message that’s typically dressed up as an bill, shared doc, calendar invite, or SharePoint entry request. The lure includes a decoy web page impersonating a trusted model or service, together with easy wording resembling “Confirm to view” or “Signature required.”
• When the sufferer clicks by way of, the web page requests a tool code from Microsoft. The code is legitimate just for quarter-hour, therefore time and timing are of the essence right here. The web page reveals the sufferer the code alongside and factors them to Microsoft’s real microsoft.com/devicelogin login portal. The catch is that the code belongs to the attacker’s session, therefore the sufferer unknowingly authorizes the attacker’s system, not their very own.
• Seeing a sound sign-in, Microsoft points entry and refresh tokens to the session opened by the attacker. As soon as inside, the criminals can entry company e-mail, information, Groups, SharePoint, OneDrive, and different Microsoft 365 assets and exfiltrate information or put together BEC assaults, which is why finance, HR, logistics, and gross sales accounts draw a lot of the attackers’ curiosity.

What makes EvilTokens harmful

The OAuth system code move was designed for units that could be awkward to signal into immediately, resembling sensible TVs or printers. The system shows a brief code that the person enters on a Microsoft web page on one other system, typically a smartphone, and completes authentication there. Microsoft then points entry tokens to the system that requested entry.

That separation is helpful, nevertheless it leaves room for abuse. Attackers can generate the code and dupe the sufferer into getting into it – all whereas Microsoft solely sees a sound authentication move. The corporate does warn customers in the meanwhile of sign-in through on-screen textual content telling them to not enter codes from sources that they don’t belief. Nevertheless, a convincing decoy is usually sufficient to get the sufferer to learn previous any warnings.

Talking of which, EvilTokens strips out lots of the purple flags that folks have been taught to note over time, together with misspelled domains and faux login pages. The login web page is actual and, from the sufferer’s viewpoint, your complete authentication course of can seem to work as anticipated.

The assault additionally ‘muddies the waters’ in relation to safeguards offered by 2FA. Whereas the second authentication layer has by no means been extra essential, it falls brief when the sufferer approves the improper session. In these assaults, attackers don’t subvert 2FA by way of any technical wizardry – slightly, they merely dupe the sufferer into finishing 2FA for them.

The best way to cut back the danger

Phishing safety suggestions clearly can’t cease at “verify the hyperlink,” not to mention “search for typos.” These habits nonetheless assist, after all, however they don’t maintain up towards fashionable assaults, particularly people who abuse actual authentication flows.

Listed below are just a few suggestions for staying secure from EvilTokens:

• Consider any sudden request for an authentication code as suspect. No doc, bill, e-mail, or one other platform ought to ask for a tool code and not using a clear motive. If the request arrives out of nowhere, flag it to your employer’s IT or safety group.
• Context issues greater than the web page. Earlier than approving any sign-in request, verify which app is asking for entry, which account is concerned, and whether or not you really began the motion. An actual Microsoft web page doesn’t robotically make a request secure.
• Organizations ought to limit system code move outright the place it’s not wanted. Microsoft recommends making use of Conditional Entry insurance policies to dam system code move wherever it isn’t vital and scope it to particular customers, units, areas, or working programs.
• Look ahead to uncommon device-code authentication, unfamiliar units, dangerous sign-ins, suspicious token use, and new inbox guidelines – any of those can level to hassle.
• Safety consciousness coaching must meet up with the most recent tips up attackers’ sleeves. Staff ought to perceive that fashionable phishing doesn’t at all times contain typing a password right into a faux web page. Typically the attacker may ask them to enter an actual code on an actual web page – however for the improper system.
• Staff who obtain an sudden device-code request ought to notify their firm’s IT or safety groups, who might must assessment sign-in logs, revoke periods, invalidate refresh tokens, take away malicious inbox guidelines, and briefly disable the compromised account.

EvilTokens is a reminder that attackers don’t at all times want to interrupt the entrance door or steal the important thing to it. Typically they solely want to speak somebody into opening it.