The Phishing Kit That Turned Microsoft’s Login Flow Into an AI-Powered Fraud Machine
EvilTokens PhaaS kit uses AI and device-code phishing to bypass MFA, compromising 12,000+ corporate inboxes for payment fraud.
EvilTokens is a phishing-as-a-service (PhaaS) kit that has compromised over 12,000 inboxes at more than 10,000 organizations by exploiting Microsoft's device-code sign-in flow. The kit, operated by Storm-2992, uses AI to generate targeted lures and automate post-compromise reconnaissance for business email compromise (BEC). Once access is gained, attackers register new devices and create hidden inbox rules to maintain persistence and evade detection.
- EvilTokens is a PhaaS kit that uses device-code phishing to bypass MFA.
- The kit compromised over 12,000 inboxes at 10,000+ organizations.
- AI features help draft lures and map organizational structures for targeted fraud.
- Attackers register new devices and create hidden inbox rules for persistence.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1539 Steal Web Session CookieT1078 Valid AccountsT1562.001 Disable or Modify ToolsT1114.002 Remote Email Collection
- Tags
- ai-assisted-fraudbusiness-email-compromisedevice-code-phishingevil-tokensmfa-bypassphishingstorm-2992
- Vendors
- Microsoft
- Products
- Microsoft Entra ID
- Threat actors
- Storm-2992
- Malware
- EvilTokens
- Organizations
- Microsoft
From the original article
3 min read at cybersecuritynews.com
EvilTokens turns a Microsoft sign-in into a route to corporate email fraud. The phishing kit, first seen in February 2026, tricks people into approving an attacker’s login through a real device code process without handing over a password. The lure usually arrives as an urgent email about an invoice, shared file, document signature or expiring […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.