TLDR
EvilTokens is a phishing as a service kit sold on Telegram that compromises Microsoft 365 accounts without fake login pages or stolen passwords. Attackers trick victims into completing a legitimate OAuth device code sign in on the real...
Como funciona
EvilTokens is a phishing as a service kit sold on Telegram that compromises Microsoft 365 accounts without fake login pages or stolen passwords. Attackers trick victims into completing a legitimate OAuth device code sign in on the real...
Señales de alerta
- An unsolicited email or chat asks you to visit microsoft.com/devicelogin and enter a short numeric code you did not request Lures use generic wording like "Verify to view" or "Signature required" paired with a decoy page impersonating a known brand The authentication flow looks completely real: no misspelled domains, no fake login form, yet Microsoft still warns that you should never enter codes from untrusted sources
Qué hacer
- 1Refuse any device code you did not personally initiate
- 2close the page and report the message to your IT team Confirm document or invoice requests via a
Fuente
welivesecurity
Fuente verificada por Mythos Forensic Team
https://www.welivesecurity.com/en/cybercrime/eviltokens-phishing-doesnt-steal-password/FAQ
Es EvilTokens: Microsoft 365 phishing that bypasses passwords and 2FA via device code hijack una estafa real?
Si. Trata el mensaje, la llamada o la solicitud de pago como sospechosos hasta que los verifiques por un canal oficial.
Cuales son las primeras senales?
An unsolicited email or chat asks you to visit microsoft.com/devicelogin and enter a short numeric code you did not request Lures use generic wording like "Verify to view" or "Signature required" paired with a decoy page impersonating a known brand The authentication flow looks completely real: no misspelled domains, no fake login form, yet Microsoft still warns that you should never enter codes from untrusted sources
Que debo hacer primero?
Refuse any device code you did not personally initiate; close the page and report the message to your IT team Confirm document or invoice requests via a
Puede LegalAudit revisar mi caso?
Si. Abre el chat gratis y pega el mensaje, el enlace, el remitente o los datos de pago para un triage.