Opinion: EvilTokens shows AI speeding Microsoft 365 device-code phishing
Original title: What EvilTokens teaches us about defending against AI-assisted attacks
Microsoft said it disrupted Storm-2992 in September after the service, found in February, used AI across the chain.
A CSO Online contributor opinion uses EvilTokens, a phishing-as-a-service platform first identified in February 2026, to argue that AI shortens the time between inbox access and fraud. The service abuses the OAuth 2.0 device authorization grant so victims authorize Microsoft 365 access without a fake login page. Microsoft said it took down Storm-2992, the actor believed to run the scheme, in September and that the operation used AI at every step. The piece urges teams to judge detection by time to impact and to test full attack paths together.
Unconfirmed: Storm-2992 is described as believed to be behind EvilTokens, and Microsoft’s claim that AI was used at every step is the company’s statement.
- EvilTokens was first identified in February 2026.
- It uses the OAuth 2.0 device code flow instead of fraudulent login pages.
- Microsoft said it took down Storm-2992 in September.
- Once inside, AI maps payment owners and drafts fraud messages from real threads.
- The author is from SimSpace and frames speed, scale, sophistication and stamina as “The Four S’s.”
Impact: Microsoft 365 inbox access used for follow-on fraud
- 1.Test email, identity and monitoring together along a full attack path.
- 2.Judge detections by time to impact, not historical MTTD or MTTR alone.
- ATT&CK
- T1566 Phishing
- Vendors
- Microsoft
- Products
- Microsoft 365
- Threat actors
- Storm-2992
- Malware
- EvilTokens
- Organizations
- SimSpace
From the original article
5 min read at csoonline.com
Cybercriminals don’t need AI to compromise an organization, but AI is making its way into classic attack methods and changing how quickly such attacks can progress. Tasks that once required attackers to manually sift through information and piece together how an organization operates can be accelerated by AI, reducing the time defenders have to detect and intervene.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.