Full Report
A new malicious kit called EvilTokens integrates device code phishing capabilities, allowing attackers to hijack Microsoft accounts and provide advanced features for business email compromise attacks. [...]
Analysis Summary
# Tool/Technique: EvilTokens
## Overview
EvilTokens is a sophisticated Phishing-as-a-Service (PhaaS) kit and framework that specializes in **OAuth 2.0 Device Code Flow phishing**. Unlike traditional credential harvesting, EvilTokens tricks victims into authorizing a malicious device flow, allowing attackers to bypass Multi-Factor Authentication (MFA) and gain persistent access to Microsoft 365 environments via session tokens.
## Technical Details
- **Type**: Phishing-as-a-Service (PhaaS) / Attack Framework
- **Platform**: Microsoft Entra ID (formerly Azure AD) / Microsoft 365 (Future support planned for Gmail and Okta)
- **Capabilities**: Device code flow abuse, Token theft (Access & Refresh), BEC automation, MFA bypass.
- **First Seen**: April 2026 (Reported by Sekoia)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1528 - Steal Application Access Token]
- [T1557 - Adversary-in-the-Middle]
- **[TA0003 - Persistence]**
- [T1136.003 - Create Account: Cloud Account] (Via token-based hijacking)
- **[TA0005 - Defense Evasion]**
- [T1550.001 - Use Alternate Authentication Material: Application Access Token]
## Functionality
### Core Capabilities
- **Device Authorization Abuse**: Exploits the OAuth 2.0 device code flow where a user enters a code on a legitimate Microsoft page to authorize the attacker's session.
- **Token Harvesting**: Captures both short-lived Access Tokens and long-lived Refresh Tokens.
- **MFA Bypass**: Since the user authenticates on a legitimate Microsoft domain, the MFA challenge is satisfied by the victim, and the resulting token is passed to the attacker.
- **Phishing Templates**: Includes high-quality templates impersonating Adobe Acrobat, DocuSign, SharePoint, and logistics/finance documents.
### Advanced Features
- **BEC Automation**: Integrated tools specifically designed to facilitate Business Email Compromise (BEC) once access is gained.
- **Multi-Format Lures**: Supports delivery via QR codes or hyperlinks embedded in PDF, HTML, DOCX, XLSX, and SVG files.
- **Infrastructure as a Service**: Sold via Telegram with a centralized backend for managing victims and harvested tokens.
## Indicators of Compromise
*Note: Specific hashes and IPs depend on specific campaign deployments; the following are behavioral and general indicators reported.*
- **Network Indicators**:
- `login[.]microsoftonline[.]com` (Abused legitimate domain)
- `microsoft[.]com/devicelogin` (Abused legitimate domain)
- Known Phishing Infrastructure: [Consult Sekoia report for specific defanged C2 domains]
- **Behavioral Indicators**:
- Sign-ins from unusual locations or devices using a "Device Code" flow.
- Unexpected "Cross-Tenant" or "Public Client" application authorizations in Entra ID logs.
- New device registrations or application permissions granted to "Microsoft Command Line Interface" or other default Microsoft apps.
## Associated Threat Actors
The kit is used by various cybercriminals, with the technique previously utilized by:
- **Storm-237**
- **ShinyHunters**
- **UTA032 / UTA0355**
- **TA2723**
## Detection Methods
- **Log Analysis**: Monitor Microsoft Entra ID (Azure AD) Sign-in logs for `Authentication Requirement: MFA` combined with `Authentication Protocol: Device Code`.
- **Identity Protection**: Alert on "Unusual Sign-in Properties" or "Impossible Travel" involving token-based access.
- **YARA Rules**: Sekoia has released YARA rules specifically targeting the HTML structure of EvilTokens phishing templates.
- **Email Filtering**: Scan attachments (PDF, SVG, HTML) for embedded QR codes or redirects to known phishing relay URLs.
## Mitigation Strategies
- **Technical Restrictions**: Disable the **Device Code Flow** in Entra ID if it is not required for business operations.
- **Conditional Access**: Implement strict Conditional Access (CA) policies that require Compliant or Hybrid Joined devices, which can block unauthorized device flow tokens.
- **Continuous Access Evaluation (CAE)**: Enable CAE to revoke tokens immediately upon detected risk.
- **User Training**: Educate users to never enter a "Device Code" unless they manually initiated a login on a secondary device (like a Smart TV or printer).
## Related Tools/Techniques
- **EvilProxy / Tycoon / LabHost**: Similar PhaaS kits focusing on Adversary-in-the-Middle (AiTM) tactics.
- **OAuth Phishing**: General technique for stealing application permissions rather than just passwords.