Microsoft Warns of EvilTokens AI Phishing Service Hijacking Thousands of Accounts
EvilTokens PaaS hijacks device-code auth to steal tokens and enable BEC at scale, compromising 12,000+ inboxes across 10,000+ organizations.
Microsoft warns that the EvilTokens phishing-as-a-service platform has compromised over 12,000 email inboxes across 10,000+ organizations since February 2026. The platform, linked to threat actor Storm-2992, industrializes device-code authentication hijacking for large-scale token theft and business email compromise. EvilTokens uses AI to generate tailored lures and sophisticated infrastructure to evade detection.
- EvilTokens PaaS compromises 12,000+ inboxes across 10,000+ organizations.
- Exploits OAuth device-code flow for token theft and BEC.
- Automated kit with AI-lure generation and stealthy infrastructure.
- Storm-2992 campaigns target finance, healthcare, and education globally.
- Microsoft recommends blocking device-code auth and monitoring for anomalous sign-ins.
- ATT&CK
- T1566 PhishingT1621 Multi-Factor Authentication Request GenerationT1539 Steal Web Session Cookie
- Vendors
- Microsoft
- Products
- Microsoft Graph
- Threat actors
- Storm-2992
- Malware
- EvilTokens
- Victims
- Over 10,000 organizations
- Organizations
- Microsoft
From the original article
4 min read at gbhackers.com
Microsoft has warned that the EvilTokens phishing-as-a-service platform has become a major driver of AI-enabled device-code phishing, compromising more than 12,000 email inboxes across over 10,000 organizations worldwide since emerging in February 2026.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.