EvilTokens Seized: AI Phishing Bypassed MFA on 12,000 Inboxes

Microsoft seized 50 websites and killed 150+ supporting domains on September 22, dismantling EvilTokens — a phishing-as-a-service platform that had bypassed MFA on 12,000 email accounts across 10,000 organizations in 79 countries. Two operators are under arrest. The service is dead. The attack technique it exploited is still live in your tenant, and most teams have not blocked it.

Your MFA Did Not Protect You #

EvilTokens did not steal passwords. It did not intercept MFA codes. It abused a legitimate OAuth feature — the device authorization flow — designed for input-constrained devices like smart TVs and printers. Here is what happened to victims:

1. An attacker’s script requested a device code from Microsoft’s auth server.
2. A phishing email landed — one of 44 different lure templates: fake invoices, RFPs, urgent security alerts, fake CAPTCHAs. The link pointed to the real Microsoft sign-in page at microsoft.com/devicelogin.
3. The victim authenticated normally — username, password, MFA prompt, the works — on a legitimate Microsoft domain.
4. The attacker’s script was polling Microsoft every 3–5 seconds. The moment authentication completed, the attacker received a valid access token.
5. Password resets did nothing. Tokens remained valid until explicitly revoked via the Microsoft Graph API.

Standard MFA is structurally irrelevant to this attack class. The victim completed a real authentication flow on a real Microsoft domain. There was nothing suspicious to flag.

AI Ran the Attack Chain — and Built the Platform #

Once inside a mailbox, EvilTokens used AI to automate what traditionally required a skilled social engineer. Within ten minutes of breach:

• Inbox rules were created to hide attacker communications
• Microsoft Graph API calls mapped the organization’s full hierarchy and permissions
• The AI read emails in 20+ languages, identified “money movers,” flagged wire transfer discussions and vendor invoices
• Impersonation messages were auto-drafted, tailored to the specific compromised thread

That is the AI-enabled business email compromise (BEC) pipeline. The more uncomfortable detail: EvilTokens itself was largely vibe-coded. The operators used AI to build the platform. Capabilities that once required deep expertise in identity attacks, cloud systems, and social engineering were assembled into a $1,500 subscription with a Telegram storefront.

“Capabilities that once required experience across identity attacks, cloud systems, social engineering, and financial fraud were available through a ready-made interface.”

—Microsoft On the Issues That quote describes both EvilTokens and every PhaaS platform that follows it. This is not a one-off. Microsoft’s technical analysis identifies 14+ distinct device code phishing kits now in circulation. EvilTokens was the most prevalent. It will not be the last.

The Scale #

EvilTokens launched in February 2026. By the time Microsoft moved, it had generated $1.1 million in revenue from 700+ cryptocurrency wallets on the Tron blockchain. Device code phishing surged 1,380% between the second half of 2025 and the first half of 2026. The sectors hit hardest: financial services, real estate, healthcare, construction, and higher education across 79 countries.

The September 22 takedown involved Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs. Health-ISAC joined as co-plaintiff given the healthcare sector’s exposure. It was Microsoft’s 40th court-authorized disruption operation.

What You Need to Do Right Now #

The attack infrastructure is gone. The technique remains. Device code flow is enabled by default in most Microsoft 365 tenants, and most organizations have no legitimate business need for it. Here is the fix:

1. Block device code flow in Entra ID. Go to Entra ID → Protection → Conditional Access → New Policy. Under Conditions → Authentication flow, selectDevice code flow . Set Grant toBlock access . Start in Report-only mode first to catch legitimate use cases (some CLI developer tools use device code auth), then enforce.
2. Enable phishing-resistant authentication. FIDO2 hardware keys and Microsoft Authenticator passkeys bind the credential to the origin — they are not susceptible to device code phishing. Push MFA notifications are not phishing-resistant.
3. Set sign-in risk policies. Entra ID Protection can automatically block or step up authentication when anomalous device code activity is detected. Not a replacement for step 1, but it catches what slips through.
4. Monitor for post-auth Graph activity. Microsoft Defender XDR detects “Anomalous OAuth device code authentication activity” and “Anomalous Microsoft Graph API requests following device code flow authentication.” If you see these alerts, assume breach and revoke tokens immediately.
5. Revoke tokens for suspected accounts using therevokeSignInSessions Microsoft Graph API call. Revocation is not instant — allow up to one hour for active sessions to expire. Disabling the account is faster when speed matters.

The Bigger Picture #

EvilTokens is a data point in an accelerating trend. AI has commoditized sophisticated identity-based attacks. The $1,500 entry price is not the floor — it is the ceiling for this generation. The next iteration will be cheaper, more capable, and harder to attribute.

Device code flow is one vector. The broader lesson: audit every authentication flow your organization permits. Most of them exist because no one turned them off, not because anyone deliberately turned them on.