Skyw4lker device-code phishing targets US Microsoft 365 accounts
Password-protected contract lures and Google Sites lead victims into a real Microsoft login that hands over tokens.
2
Stories per day · 30 days
6 RSS
Relatedmicrosoft-3655aitm3inbox-rules3phishing3business-email-compromise2entra-id2skyw4lker2adversary-in-the-middle1clickfix1email-security1entra1gabagool1google-sites1iron-man1law-enforcement1microsoft1oauth1phishing-kit1
33 stories, newest first · one card per story
Stories tagged #device-code-phishing
SkyW4lker phishing kit abuses Microsoft 365 device-code login
ANY.RUN linked 618 analyses from June through October 21, 2026, with monthly cases rising from 20 to 200.
1
Huntress ranks RMM abuse and mailbox attacks atop SMB threats
Huntress says RMM abuse was 45% of Q1 2026 endpoint incidents and mailbox manipulation 24.6% of 2026 ITDR signals.
1
Stolen login tokens used to hijack Microsoft 365 accounts at 79 organizations
Huntress counted 497 successful sign-ins and more than 200,000 failures from July 14 to September 22, 2026.
1
Microsoft 365 token-replay campaign hit 97 accounts at 79 organizations
Huntress logged 497 successful sign-ins and 48 rogue Entra devices between July 14 and September 22, 2026.
1
Stolen Microsoft 365 sessions replayed at 79 organizations
Huntress counted 497 successful sign-ins and over 200,000 failures from July 14 to September 22, with inbox rules hiding mail.
1
Proofpoint says generative AI is weakening email behavior detection
One actor emailed more than 30 agents with unique property pitches that all ended in the same meeting request.
1
Global takedown hits network behind 1 billion phishing messages
Microsoft and police disrupted a phishing marketplace and kits behind more than a billion malicious messages.
Midnight Blizzard Abuses Hotel Wi-Fi Captive Portals to Deliver Malware and Steal Credentials
Midnight Blizzard’s CaptiveCrunch campaign abuses hotel Wi-Fi portals to deliver malware and steal cloud credentials.
5
How RMM abuse gives attackers a way in that looks like business as usual
Huntress reports attacker RMM abuse in 45% of Q1 2026 endpoint incidents, up 277% YoY, delivered via phishing lures stacking multiple remote-access tools.
Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
Huntress finds RMM abuse, mailbox-rule BEC, and AiTM token theft most often disrupt SMBs.
Phishing Response: 3 Steps SOC Teams Can Take to Investigate Threats Faster
ANY.RUN pitched sandbox updates that speed phishing triage, using an EvilTokens device-code campaign as the example.
Phishing Response Protocol: 3 Essential SOC Steps Powered by ANY.RUN’s Latest Product Updates
ANY.RUN promotes three SOC steps for faster phishing response using new sandbox and reporting features.
Major Cyber Attacks in September 2026: US Organizations Face Session Theft, Remote Access, and Payment Fraud
September campaigns CSuite, N0va, and IronToll phished US organizations for Microsoft 365 sessions, tokens, and payment data.
6
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
Weekly recap led by actively exploited Citrix NetScaler ADC/Gateway flaws CVE-2026-88771 and CVE-2026-88772, plus the $387M Bitget hack and EvilTokens takedown.
How device code phishing gives scammers access to your account
Device code phishing tricks users into approving a real OAuth sign-in, handing attackers account tokens.
3
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
Microsoft disrupted EvilTokens, an AI-powered phishing platform that compromised 12,000+ email accounts across 10,000+ organizations.
4
EvilTokens made phishing-as-a-service look easy. Then it got taken down
Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.
3
Microsoft’s EvilTokens takedown sheds light on state of AI-powered cybercrime
Microsoft seized EvilTokens infrastructure after the AI phishing service compromised about 12,000 Microsoft 365 inboxes.
1
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft dismantled EvilTokens, an AI-assisted device-code phishing service linked to about 12,000 inbox takeovers.
1
Two arrested in UK after Microsoft takedown of ‘Eviltokens’ AI-chatbot for cybercriminals
Microsoft's court-authorized takedown of the EvilTokens AI phishing platform led to two UK arrests; the service had access to 12,000+ compromised inboxes.
1
Unmasking EvilTokens: Getting to the root of device code phishing
Microsoft details the EvilTokens/Storm-2992 device-code phishing operation and shares Defender detections after disrupting the AI-powered platform.
5
GhostCode attackers abuse device codes to take over Microsoft 365 accounts
GhostCode phishing kit abuses Microsoft's OAuth device authorization flow to harvest tokens, register devices, and steal primary refresh tokens from M365 victims.
5
GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds
eSentire identified GhostCode, a phishing kit abusing Microsoft 365 OAuth device-code sign-in to steal tokens and take over accounts in seconds.
6