Unmasking EvilTokens: Getting to the root of device code phishing
Microsoft details the EvilTokens/Storm-2992 device-code phishing operation and shares Defender detections after disrupting the AI-powered platform.
Microsoft Threat Intelligence published comprehensive analysis of EvilTokens, a PhaaS tracked to actor Storm-2992 that compromised more than 12,000 inboxes at over 10,000 organizations worldwide since February 2026. The platform abused the OAuth device code authentication flow to bypass MFA, then used stolen tokens for mailbox persistence via malicious inbox rules and new device grants, with Microsoft Graph reconnaissance for mapping organizations and lateral movement. Delivery used 44 lure themes (invoices, RFPs, shared files) with malicious URLs, PDFs, HTML files, and thousands of short-lived Node.js polling nodes to evade detection. Microsoft recommends blocking device code flow wherever possible and provides Defender detection and hunting guidance plus mail-flow hardening steps.
- Device code phishing decouples authentication from session context, bypassing MFA
- Stolen tokens enable persistence via malicious inbox rules and new device registration
- Microsoft Graph reconnaissance maps org structure for lateral movement
- 44 lure themes plus Node.js short-lived polling nodes evade gateway and endpoint detection
- Microsoft publishes Defender detections and recommends blocking device code flow
- ATT&CK
- T1566.002 Spearphishing LinkT1557 Adversary-in-the-MiddleT1550.001 Application Access TokenT1137.005 Mailbox ManipulationT1087 Account Discovery
- Threat actors
- Storm-2992
From the original article
12 min read at microsoft.com
EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption of EvilTokens infrastructure and operations.
microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.