TLDR
EvilTokens is a phishing as a service kit sold on Telegram that compromises Microsoft 365 accounts without fake login pages or stolen passwords. Attackers trick victims into completing a legitimate OAuth device code sign in on the real...
How it works
EvilTokens is a phishing as a service kit sold on Telegram that compromises Microsoft 365 accounts without fake login pages or stolen passwords. Attackers trick victims into completing a legitimate OAuth device code sign in on the real...
Red flags
- An unsolicited email or chat asks you to visit microsoft.com/devicelogin and enter a short numeric code you did not request Lures use generic wording like "Verify to view" or "Signature required" paired with a decoy page impersonating a known brand The authentication flow looks completely real: no misspelled domains, no fake login form, yet Microsoft still warns that you should never enter codes from untrusted sources
What to do
- 1Refuse any device code you did not personally initiate
- 2close the page and report the message to your IT team Confirm document or invoice requests via a
Source
welivesecurity
Source reviewed by Mythos Forensic Team
https://www.welivesecurity.com/en/cybercrime/eviltokens-phishing-doesnt-steal-password/FAQ
Is EvilTokens: Microsoft 365 phishing that bypasses passwords and 2FA via device code hijack a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
An unsolicited email or chat asks you to visit microsoft.com/devicelogin and enter a short numeric code you did not request Lures use generic wording like "Verify to view" or "Signature required" paired with a decoy page impersonating a known brand The authentication flow looks completely real: no misspelled domains, no fake login form, yet Microsoft still warns that you should never enter codes from untrusted sources
What should I do first?
Refuse any device code you did not personally initiate; close the page and report the message to your IT team Confirm document or invoice requests via a
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.