EvilTokens uses device-code sign-ins to compromise mailboxes

Microsoft described EvilTokens on 22 September as a phishing service abusing device-code authentication. Its report linked the infrastructure with more than 12,000 compromised inboxes across over 10,000 organisations. Those are the company’s reported observations and attribution, not an independent global incident count.

Researchers said operators used stolen tokens to obtain mail and establish persistence, including inbox rules that concealed communications. They also described AI-assisted tailoring of lures and analysis of accessible mail. The central risk is authorising a sign-in requested by an attacker through an otherwise legitimate authentication process. Recognising the sign-in provider alone does not show whose device or session receives the resulting access.