A new harmful tool called EvilTokens uses device code phishing, letting hackers take over Microsoft accounts and offering sophisticated capabilities for business email hacking.

This tool is being sold to criminals on Telegram and is constantly being improved. The creator plans to add support for phishing pages for Gmail and Okta.

Device code phishing attacks take advantage of the OAuth 2.0 device authorization process. Attackers trick users into authorizing a malicious device, giving them access to the victim’s account.

This method is well-known and has been employed by various malicious actors, including Russian groups labeled Storm-237, UTA032, UTA0355, UNK_AcademicFlare, and TA2723 [1, 2, 3], and the ShinyHunters data theft group.

Researchers at Sekoia, a threat detection and response firm, have seen EvilTokens attacks where victims received emails containing documents (PDF, HTML, DOCX, XLSX, or SVG) with a QR code or a link to a fake EvilTokens page.

These deceptive emails mimic real business communications, like financial documents, meeting invites, shipping or purchase orders, payroll notifications, or shared files via services like DocuSign or SharePoint. They often target employees in finance, HR, logistics, or sales.

When the victim clicks the link, they see a fraudulent page resembling a trusted service (like Adobe Acrobat or DocuSign). This page displays a verification code and asks them to verify their identity.

The page then asks the user to click a “Continue to Microsoft” button, which redirects them to the actual Microsoft device login page.

Here, the attacker uses a real client (any Microsoft application) to request a device code. They then manipulate the victim into authenticating on the legitimate Microsoft URL, but for the attacker’s benefit.

By doing this, the attacker gets both a temporary access code and a refresh token for ongoing access.

These tokens grant the attacker immediate access to the services linked to the victim’s account, including email, files, Teams data, and the ability to impersonate the user across Microsoft services through SSO.

Sekoia researchers investigated EvilTokens’ setup and found campaigns operating worldwide, with the most affected countries being the United States, Canada, France, Australia, India, Switzerland, and the UAE.

Besides advanced phishing, Sekoia researchers report that the EvilTokens phishing-as-a-service (PhaaS) also includes “advanced features to carry out BEC [business email compromise] attacks” via automation.

The variety of campaigns indicates that EvilTokens is widely used by malicious actors involved in phishing and business email compromise (BEC).

Sekoia is providing indicators of compromise (IoC), technical information, and YARA rules to help defenders stop attacks using the EvilTokens PhaaS kit.