In breve
EvilTokens is a phishing as a service kit sold on Telegram that compromises Microsoft 365 accounts without fake login pages or stolen passwords. Attackers trick victims into completing a legitimate OAuth device code sign in on the real...
Come funziona
EvilTokens is a phishing as a service kit sold on Telegram that compromises Microsoft 365 accounts without fake login pages or stolen passwords. Attackers trick victims into completing a legitimate OAuth device code sign in on the real...
Indicatori rossi
- An unsolicited email or chat asks you to visit microsoft.com/devicelogin and enter a short numeric code you did not request Lures use generic wording like "Verify to view" or "Signature required" paired with a decoy page impersonating a known brand The authentication flow looks completely real: no misspelled domains, no fake login form, yet Microsoft still warns that you should never enter codes from untrusted sources
Cosa fare
- 1Refuse any device code you did not personally initiate
- 2close the page and report the message to your IT team Confirm document or invoice requests via a
Fonte
welivesecurity
Fonte verificata da Mythos Forensic Team
https://www.welivesecurity.com/en/cybercrime/eviltokens-phishing-doesnt-steal-password/FAQ
EvilTokens: Microsoft 365 phishing that bypasses passwords and 2FA via device code hijack e una truffa reale?
Si. Tratta messaggi, chiamate o richieste di pagamento come sospette finche non le verifichi da un canale ufficiale.
Quali sono i primi segnali?
An unsolicited email or chat asks you to visit microsoft.com/devicelogin and enter a short numeric code you did not request Lures use generic wording like "Verify to view" or "Signature required" paired with a decoy page impersonating a known brand The authentication flow looks completely real: no misspelled domains, no fake login form, yet Microsoft still warns that you should never enter codes from untrusted sources
Cosa devo fare subito?
Refuse any device code you did not personally initiate; close the page and report the message to your IT team Confirm document or invoice requests via a
LegalAudit puo controllare il mio caso?
Si. Apri la chat gratis e incolla messaggio, link, mittente o dati di pagamento per un triage.