Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises

1. Executive summary

Microsoft's Digital Crimes Unit, backed by a US District Court for the Eastern District of Virginia order and supported by Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs, has seized 50 websites and disabled more than 150 domains operating the EvilTokens phishing-as-a-service platform. London's Metropolitan Police Service arrested two men, aged 32 and 38, on suspicion of administering the service; both are released on bail. EvilTokens abused the OAuth 2.0 device authorization flow to bypass MFA and compromise more than 12,000 inboxes across over 10,000 organisations worldwide between February and September 2026, with financial services among the affected industries and the UK among the highest-concentration victim geographies. Microsoft tracks the operators as Storm-2992; this has no MITRE ATT&CK profile in our verified reference data, so treat the attribution as unconfirmed. No CVE is involved: the abuse vector is a legitimate Microsoft authentication flow, so patching does not address it, and identity controls plus payment-verification process controls do.

2. Regulatory framing

No NIS2 or UK NIS article is cited here: the reference material scopes those obligations at supply-chain security measures and incident reporting generally, and nothing in this item adds a trigger specific to it beyond what any account-compromise incident would raise.

3. Technical analysis & attack chain

This is a law-enforcement takedown of a criminal service, so this section describes how the service and its fraud pipeline worked, from the source facts only.

The service. EvilTokens launched in February 2026 and was sold as a subscription on Telegram (admin accounts @eviltokensadmin, @eviltokensadmins and @EvilTokenscontact; store bots @EvilTokens_bot and @EvilTokensStorebot; public channel @EvilTokensChannel). Sekoia reported the price structure: $1,500 one-time plus $500 per month, with a standalone "Portal Browser" at $500 lifetime. Microsoft observed 10 to 15 distinct campaigns launching every 24 hours from 15 March 2026, each targeting hundreds of organisations with varied payloads. By takedown, the platform had compromised more than 12,000 inboxes in over 10,000 organisations, with victim concentrations in the United States, Canada, the United Kingdom, Australia, India and France, and across wholesale distribution, construction, financial services, real estate, higher education and healthcare.

The attack chain, confirmed steps

1. A lure email reaches the victim's inbox. Talos recovered two near-identical messages sent four minutes apart on 20 April 2026 that spoofed an accounts-payable contact at a legitimate Wisconsin plumbing and fire-protection contractor, addressed to an accounts-payable recipient at a US life-sciences company. The "from" header carried the contractor's real domain; the reply-to redirected to an unrelated domain. The visible anchor text read as the vendor's genuine SharePoint tenant while the href pointed to a look-alike tenant under an attacker-controlled Microsoft 365 workspace, for example hxxps://mononapfpcom[.]sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc. Because the destination is a genuine sharepoint.com host, it inherits SharePoint's clean reputation.
2. The lure shows the victim a device code that the attacker generated against the attacker's own OAuth client. The victim is prompted to enter that code at the legitimate verification URL, microsoft.com/devicelogin.
3. The victim completes sign-in, including any MFA prompt, believing they are authenticating to a legitimate service. The authorization server issues access and refresh tokens to the attacker's client under the victim's identity. No password is stolen and no fake login page is used.
4. The attacker uses the stolen tokens for email access, exfiltration and persistence: malicious inbox rules that conceal or forward communications, and in some cases registration of new devices against the victim's inbox, which Microsoft describes as a particularly durable persistence method.
5. Post-compromise, the platform's AI tooling analyses the mailbox: summarising and translating email, mapping organisational roles via Microsoft Graph reconnaissance, identifying trusted relationships and payment authorisations, and generating tailored BEC scenarios. Sekoia's second-part research documented an AI pipeline chaining Groq-hosted Llama models for financial exposure scoring and GPT-4o-mini for email translation, producing three tailored BEC scenarios per compromised mailbox. Preset prompts existed to find wire-transfer discussions, identify "money movers", locate vendor invoices and select impersonation targets.
6. The fraud executes as BEC and invoice fraud: messages impersonating trusted contacts, drafted with the chatbot's help, sent from the compromised mailbox.

Delivery and evasion. Lures used 44 different themes including invoices, requests for proposals and shared files, delivered as malicious URLs, PDF attachments and HTML files through a multi-stage pipeline designed to bypass email gateways and endpoint security. Sekoia documented roughly 500 Cloudflare Workers domains and over 1,000 phishing pages under the EvilTokens umbrella. The affiliate panel Talos analysed ("ARToken", at dashboard-bl.pamconj[.]com, C2 API at spx.pamconj[.]com, lures deploying through Cloudflare Workers accounts such as clear90489058903-document.workers[.]dev) layered seven client-side anti-analysis checks: a User-Agent regex blocking headless browsers, Selenium, Puppeteer, Playwright, crawlers, wget and curl; a navigator.webdriver check; browser feature fingerprinting for window.chrome, navigator.vendor and touch/mouse APIs; window dimension analysis catching 0x0 headless defaults; interaction telemetry requiring 3+ mouse moves or 1+ touch events before enabling the payload; a minimum 800ms timing gate since page load; and mouse trajectory analysis validating non-linear motion. Talos rates this as more sophisticated than the server-side X-Antibot-Token mechanism documented earlier. The ARToken panel also exposed a post-exploitation toolkit with token management, persistence mechanisms, full Outlook inbox read access, email sending as the victim, inbox rule creation for forwarding and deleting messages, and keyword-based monitoring across all compromised accounts.

Confidence caveats. The ARToken panel analysis, including the seven-layer evasion stack and the specific domains, is single-sourced to Cisco Talos; verify before enforcement. The Sekoia attribution of the AI model chain (Groq-hosted Llama, GPT-4o-mini) is likewise single-sourced. The Register reports the Met arrests on 18 September; The Hacker News reports 11 September; the discrepancy is unresolved in the available material. Storm-2992 has no MITRE profile in our verified reference data, so the operator attribution is unconfirmed. One source attributes first documentation of EvilTokens to Huntress in March 2026 and another to Sekoia in March 2026; both may be correct on timing, but the priority is not established here.

4. Mitigation & containment

The takedown removes the service infrastructure, not the access it sold. Stolen refresh tokens, rogue device registrations and malicious inbox rules survive the seizure. Treat any Microsoft notification of compromise as an open incident.

P1, within 24 hours

• Revoke all active refresh tokens and session tokens for any user Microsoft has notified as affected, and for any user whose mailbox shows the behaviours in §5. In Entra ID this is "Revoke sessions" on the user object plus revocation of Microsoft 365 tokens via the relevant admin action; follow with forced re-authentication.
• Search affected and high-risk mailboxes (finance, AP, treasury, HR) for inbox rules that forward to external addresses, delete messages, or move mail to obscure folders, and remove them. Check both the rules themselves and the audit log for rule creation events.
• Review Entra ID device registrations and Microsoft 365 device access for each affected account and remove devices registered around or after the compromise date.
• Notify your payments and AP teams that any request to change payment details, redirect funds or approve unusual transactions received by email in the last six months requires verification through a trusted second channel, independent of the email thread. This is the control Microsoft's DCU general manager explicitly called for, and it is the one that breaks the BEC step regardless of token hygiene.

P2, within 72 hours

• Hunt retroactively: the compromise window runs from February 2026, so a clean mailbox today does not clear a user compromised in March. Query sign-in logs for device code flow usage (the OAuth 2.0 device authorization grant) where the client is unrecognised, and query mailbox audit logs for bulk read patterns, unusual Graph API enumeration, or sign-ins from geographies inconsistent with the user.
• Block the residual infrastructure in §5 at your email gateway, proxy and DNS filters. The 150+ disabled domains may not all remain sinkholed indefinitely.
• Enforce Conditional Access policies that require compliant or hybrid-joined devices for mailbox access, which blocks token replay from attacker-controlled clients even when a token is stolen.
• Review mail flow rules, spoof protections and third-party connector configuration per Microsoft's guidance, since the lures abused a genuine sharepoint.com destination and a spoofed real-vendor domain.

P3, within 7 days

• Run a targeted phishing exercise using a device-code lure template, since user awareness of this flow is low: the victim never sees a fake login page, only a code entry prompt at a legitimate Microsoft URL.
• Assess whether any incident identified in P1/P2 meets your DORA Art. 18 classification criteria and, if so, report under DORA Art. 19 within the applicable deadline.
• Add device-code flow monitoring to standing detection: alert on device code authentication events for accounts in payment-approval roles.

5. Indicators of compromise

No compromised-account indicators are available in the source material; Microsoft notified affected customers directly. The following are service-infrastructure and operator indicators.

domain  dashboard-bl[.]pamconj[.]com
domain  spx[.]pamconj[.]com
domain  clear90489058903-document[.]workers[.]dev
url  hxxps://mononapfpcom[.]sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc
telegram  @eviltokensadmin
telegram  @eviltokensadmins
telegram  @EvilTokenscontact
telegram  @EvilTokens_bot
telegram  @EvilTokensStorebot
telegram  @EvilTokensChannel

Behavioural indicators

6. Detection

The sources give no file artefacts, so a YARA rule is not warranted. The log-level behaviours are well specified and support a Sigma rule.

title: Suspicious OAuth Device Code Flow Authentication
id: 7c3f1a92-4d8e-4b1a-9f6a-2e5c8d0b7a41
status: experimental
description: >
  Detects authentication via the OAuth 2.0 device authorization grant, the flow
  abused by the EvilTokens / Storm-2992 phishing-as-a-service platform to capture
  tokens and bypass MFA. Tune to your baseline: some legitimate devices (Teams
  rooms, printers) use this flow.
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/
  - https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/
author: Adverse Trace
date: 2026-09-22
logsource:
  product: microsoft365
  service: azuread.signinlogs
detection:
  selection:
    properties.authenticationProtocol: deviceCode
  filter_legitimate_apps:
    appId:

      - '<known first-party app IDs>'
  condition: selection and not 1 of filter_*
falsepositives:

  - Legitimate devices using device code flow (smart TVs, printers, Teams devices, conferencing hardware)
level: high

title: Inbox Rule Creation Forwarding to External Address
id: a8d4b2f6-1c9e-4f7a-b3d5-6e2a9c0f8b73
status: experimental
description: >
  EvilTokens post-compromise persistence includes malicious inbox rules that
  forward or delete messages to conceal attacker activity. Detects new inbox
  rule creation with forwarding to an external domain.
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/
author: Adverse Trace
date: 2026-09-22
logsource:
  product: microsoft365
  service: exchange
detection:
  selection:
    event_id: 'Set-InboxRule'
    operation|contains:

      - 'New-InboxRule'
      - 'Set-InboxRule'
  forward_external:
    parameters.forwardto|contains: '@'
  condition: selection and forward_external
falsepositives:

  - User-configured legitimate forwarding
level: high

7. Sources

• The Hacker News, "Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises", https://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.html, 2026-09-22
• The Register Security, "UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites", https://www.theregister.com/security/2026/09/22/uk-cops-arrest-2-eviltokens-suspects-microsoft-seizes-50-phishing-kit-websites/5298317, 2026-09-22
• Microsoft Threat Intelligence, "Unmasking EvilTokens: Getting to the root of device code phishing", https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/, 2026-09-22
• The Register Security, "EvilTokens device-code phishing kit totally more evil than we all thought", https://www.theregister.com/cyber-crime/2026/07/01/eviltokens-device-code-phishing-kit-totally-more-evil-than-we-all-thought/5265409, 2026-07-01
• Cisco Talos, "ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365", https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/, 2026 (no exact date in source material)
• ESET WeLiveSecurity, "EvilTokens: A phishing attack that doesn't steal your password", https://www.welivesecurity.com/en/cybercrime/eviltokens-phishing-doesnt-steal-password/, no date in source material
• BleepingComputer, "ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit", https://www.bleepingcomputer.com/news/security/artoken-phaas-exposes-eviltokens-microsoft-365-phishing-toolkit/, no date in source material

8. Adverse Trace position

We assess this takedown as high-impact but incomplete for defenders: the infrastructure is seized, two alleged administrators are on bail, and the service is offline, but every token, device registration and inbox rule the platform sold remains valid until individually revoked, and Microsoft's own DCU general manager states the model will outlive this instance. Financial services clients in the UK, France and the wider EMEA region sit inside the observed victim geography and industry set, and the platform's preset prompts targeted exactly the roles our clients expose to payment flows: AP staff, finance professionals and approvers. The ARToken panel detail and the specific domains are single-sourced to Cisco Talos, the arrest date is inconsistently reported across sources, and Storm-2992 has no MITRE profile in our verified reference data, so we treat operator attribution as unconfirmed and will not propagate it into client attribution briefings. We will monitor for the full Microsoft Threat Intelligence technical blog, the Sekoia two-part series, and any post-takedown sinkhole data from Shadowserver, and we will issue a follow-up with the complete IOC set and Microsoft Defender hunting guidance once those sources are in hand.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.