Flare\u00a0said in a report<\/a> shared with Cyber Security News (CSN) that EvilTokens was first documented in February 2026 and is sold mainly through Telegram. <\/p>\n Its offer couples session capture with post-compromise analysis, making the service useful even to affiliates with limited knowledge of financial fraud.<\/p>\n The reported scale is notable, but estimates should not be merged. A 16-day wave affected 344 organizations across five countries, while separate research found more than 1,000 infrastructure-related search results and 66 email attachments leading to EvilTokens pages. Together, the findings show a service moving quickly from advertising into use.<\/p>\n EvilTokens Doesn\u2019t Just Steal Microsoft Sessions<\/p>\n The decisive feature is what happens after token theft. EvilTokens searches mailboxes for invoices, payment requests, pending transactions, and past exchanges. <\/p>\n It then identifies suppliers, decision-makers, and people who approve payments, while mapping the normal language and approval steps used by the organization.<\/p>\n That information gives attackers a shortcut to a believable follow-up scam. The platform\u2019s AI functions summarize the email data and create messages shaped around real business relationships. <\/p>\n Instead of guessing who should receive a fake invoice or urgent payment request, an affiliate can target a known, trusted contact.<\/p>\n This is why the\u00a0Microsoft 365 phishing panel<\/a>\u00a0reports matter. Related panels show that device-code abuse is becoming a repeatable service rather than a one-off technique. <\/p>\n EvilTokens applies the model to the difficult stage: turning a valid session into an understanding of a company\u2019s money flow and the people inside it.<\/p>\n The platform can also make the fraud faster and more personal. By using details from authentic conversations, criminals can imitate a vendor or colleague without starting from a generic template. <\/p>\n That lowers the experience needed to conduct business email compromise and increases the pressure on finance teams.<\/p>\n The result is an attack chain that combines access, research, and impersonation in one subscription. It also reframes the risk of a stolen token: the intruder may not merely read email, but use the mailbox to select the next victim and prepare a tailored request.<\/p>\n Device-Code Attacks Demand Tighter Controls<\/p>\n EvilTokens does not need to capture a password or defeat MFA in the usual sense. The victim completes both on a legitimate Microsoft page, but unknowingly approves the attacker\u2019s waiting session. Microsoft then issues tokens to the session initiated by the criminal.<\/p>\n The timing is calculated. Microsoft device codes last 15 minutes, so the service generates a fresh code only when a target opens the phishing page. <\/p>\n This\u00a0ongoing token theft campaign<\/a>\u00a0approach makes the approval look routine while ensuring the attacker still has time to collect the issued tokens.<\/p>\n Organizations should restrict device-code authentication to approved needs, or disable it where it is not required. <\/p>\n Security teams should alert on unexpected device-code grants, unfamiliar devices, unusual locations, new token issuance, and suspicious consent activity. Shorter token lifetimes and prompt session revocation can reduce the value of a successful approval.<\/p>\n Users also need a simple rule: a real login page does not prove that a request is safe. They should treat unexpected codes, approval prompts, and verification requests as suspicious and report them. <\/p>\n Coverage of an\u00a0earlier EvilTokens campaign<\/a>\u00a0shows why familiar Microsoft branding can make these lures persuasive.<\/p>\n Defenders should also watch what follows a successful sign-in: large mailbox searches, new inbox rules, token reuse, access to cloud data, and messages sent in a user\u2019s name. <\/p>\n The\u00a0OAuth device code phishing<\/a>\u00a0trend makes clear that detection cannot stop at the original email. It must continue through the account activity that follows.<\/p>\nEvilTokens Telegram channel (Source \u2013 Flare)<\/p>\n
EvilToken\u2019s attack flow (Source \u2013 Flare)<\/p>\n