Unmasking EvilTokens: Getting to the root of device code phishing

1. Executive summary

Microsoft's Digital Crimes Unit, working with Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs, has executed a court-authorised disruption of the EvilTokens phishing-as-a-service platform, seizing 50 websites and disabling more than 150 supporting domains; London's Metropolitan Police arrested two suspected administrators, aged 32 and 38, on 18 September 2026. Before disruption, EvilTokens was used to compromise more than 12,000 inboxes across over 10,000 organisations worldwide, including in financial services, with victim concentrations in the United States, Canada, the United Kingdom, Australia, India and France. The platform abused the OAuth 2.0 device code flow (RFC 8628) to bypass MFA entirely, then used AI to mine compromised mailboxes, score financial exposure and generate tailored BEC lures, with persistence via device registration and malicious inbox rules. Microsoft tracks the operator as Storm-2992; this actor has no MITRE ATT&CK profile, so attribution is unconfirmed. The infrastructure is disrupted but the compromise model is not: any mailbox tokenised before the takedown may still be under actor control, and payment-diversion fraud attempts from already-compromised mailboxes remain the primary near-term risk to EMEA financial services clients.

2. Regulatory framing

No UK NIS 2018 duty is engaged by this item on the facts available: the victim concentration in the United Kingdom establishes exposure but not a specific OES/RDSP trigger.

3. Technical analysis & attack chain

How the platform operated, from lure to persistence. The chain below is corroborated across the Microsoft blog, Cisco Talos and Sekoia-derived reporting; the ARToken affiliate detail is single-sourced to Talos.

1. Lure delivery. A targeted email reaches the victim, spoofing a real vendor relationship: in the Talos case, an accounts-payable contact at a legitimate Wisconsin contractor, addressed to an accounts-payable recipient at a US life-sciences company, using an outstanding-invoice theme. The visible anchor text reads as the vendor's genuine SharePoint tenant; the actual href points to a look-alike tenant under an attacker-controlled Microsoft 365 workspace, so the destination is a genuine sharepoint.com host and inherits its clean reputation. The reply-to redirects to an unrelated domain. Lure themes across the platform number 44, including invoices, RFPs, shared files, document signing, password expiration notices, construction bid proposals and compensation/benefits.
2. Redirect chain. The link does not resolve directly to the phishing page. Traffic passes through compromised legitimate domains and high-reputation serverless platforms, with heavy reliance on Vercel (.vercel.app), Cloudflare Workers (.workers.dev) and AWS Lambda, so it blends with legitimate enterprise cloud traffic and evades domain blocklists.
3. Anti-analysis gate. The landing page runs client-side behavioural verification: User-Agent regex blocking headless browsers, Selenium, Puppeteer, Playwright, crawlers, wget and curl; a navigator.webdriver check; browser feature fingerprinting for missing window.chrome, navigator.vendor or touch/mouse APIs; window dimension analysis catching 0x0 headless defaults; interaction telemetry requiring 3+ mouse moves or 1+ touch events before enabling the payload; a minimum 800ms timing gate since page load; and movement pattern analysis validating non-linear mouse trajectories. Fake CAPTCHA checks add a user-interaction requirement before the phishing content displays.
4. Device code generation. A background automation script interacts with the Microsoft identity provider in real time to generate a live device code. The page displays the code with a "Copy Code" button and a "Continue" / "Continue with Microsoft" button that redirects to the official microsoft.com/devicelogin portal. The script often copies the code to the user's clipboard automatically.
5. Polling. The script enters a polling state using a checkStatus() function, pinging the threat actor's /state endpoint every three to five seconds (setInterval) with the secret session identifier, monitoring the 15-minute device code validity window. Status returns "pending" until the user completes authentication.
6. Token capture. The user pastes the code at the legitimate Microsoft sign-in page. If they have no active session they enter password and MFA; if already signed in, pasting and confirming alone authenticates the actor's session. The actor obtains the token without ever seeing the password, and MFA is satisfied on the user's side of a flow the actor initiated.
7. Post-compromise. Within 10 minutes in some incidents, the actor registered a new device to mint a Primary Refresh Token (PRT) for long-term persistence. In other cases the actor waited several hours before creating malicious inbox rules (forwarding and deleting messages) or exfiltrating email, to avoid immediate detection. The panel provides token auto-refresh, admin detection, keyword-based inbox monitoring with alerts via Telegram, and Microsoft Graph reconnaissance to map organisational structure and permissions for lateral movement while tokens remain valid.
8. BEC monetisation. The AI pipeline chains Groq-hosted Llama models for financial exposure scoring and GPT-4o-mini for email translation, producing three tailored BEC scenarios per compromised mailbox. The actor can then send phishing or payment-diversion emails from the compromised account to internal and external contacts, inheriting its trust.

Platform economics and infrastructure. EvilTokens emerged in February 2026 and was sold via Telegram at $1,500 initial purchase plus $500 per month, with add-on products (Antibot redirector, B2B Sender, Office 365 Capture Link, SMTP Sender) priced separately for 30-day access, and a standalone "Portal Browser" at $500 lifetime. Sekoia documented roughly 500 Cloudflare Workers domains and over 1,000 phishing pages under the EvilTokens umbrella by April 2026. Microsoft observed 10 to 15 distinct campaigns launching every 24 hours from 15 March 2026, each targeting hundreds of organisations. Deployment options in the subscriber panel include Cloudflare Workers/Bunny or PHP hosting, capture mode, layout and template, code display style, page language, CAPTCHA, AI mode and captured-text handling.

Attribution and confidence. Microsoft tracks the developer and support actor as Storm-2992. Storm-2992 has no MITRE ATT&CK profile in the verified reference data, so this attribution is unconfirmed and should not be treated as established. The ARToken affiliate findings (panel at dashboard-bl.pamconj[.]com, C2 API at spx.pamconj[.]com, deployment via clear90489058903-document.workers[.]dev, identical API contract to the one Sekoia documented) are single-sourced to Cisco Talos; verify independently before enforcement action against those assets.

4. Mitigation & containment

P1, within 24 hours:

• Block the OAuth 2.0 device code flow for all users via Conditional Access. Where Teams rooms or other limited-interface devices require it, scope the exception to those specific device resource accounts and exclude the Device Registration Service resource from the policy, per Microsoft's guidance.
• Hunt for prior compromise rather than assume the takedown closed the exposure: search Entra ID sign-in logs for device code flow authentications (error code 0 or successful token issuance via device code grant) over at least the last 30 days, cross-referenced with subsequent device registrations and inbox rule creation. Any hit is a live incident, not a historical note.
• Revoke all active refresh tokens and PRTs for any account with a confirmed or suspected device code phishing sign-in, then require reauthentication. Invalidate registered devices created within 10 minutes of an anomalous device code authentication.
• Review and remove inbox rules created after any anomalous sign-in, specifically rules that forward to external addresses or delete/move messages matching payment, invoice or notification keywords.

P2, within 72 hours:

• Enforce spoof protection and mail flow rules per Microsoft's guidance, including configuration of third-party connectors to prevent spoofed phishing messages reaching inboxes; the Talos lure relied on a spoofed vendor domain with a mismatched reply-to, which connector-level spoof checks catch.
• Treat clicks on .vercel.app, .workers.dev and AWS Lambda URLs from finance and accounts-payable staff as high-priority triage events; these platforms carried the redirect logic and their traffic blends with legitimate cloud use.
• Brief accounts-payable and payments teams: independently verify any request to change payment information, redirect funds or approve unusual transactions through a trusted second channel. This is Microsoft's stated lesson from the operation and it addresses the monetisation step directly, which technical controls do not cover.
• Confirm Defender coverage is active for the detections Microsoft lists: Anomalous OAuth device code authentication activity, Anomalous token exchange following device code authentication, Suspicious Entra device join or registration, Device registration after potential device code phishing, Anomalous Microsoft Graph API activity (and POST activity) after potential device code phishing, and Suspicious inbox rule created after potential device code phishing sign-in. Enable Safe Links and Entra ID Protection to raise high-confidence device code phishing alerts.

P3, within 7 days:

• Run the Microsoft advanced hunting queries from the blog: the URL-click correlation query joining Defender for Office 365 alerts with Entra ID identity data and DeviceEvents BrowserLaunchedToOpenUrl events, and the delivered-phishing query over EmailEvents filtering DeliveryLocation to Inbox/Junk. Extend the hunting window to the last 30 days. Convert any high-value query into a custom detection rule.
• Add user awareness content covering the specific social engineering pattern: a page showing a code with a "Copy Code" button and a redirect to the genuine microsoft.com/devicelogin portal. The legitimate-looking destination is the reason standard phishing training fails here.
• Where both DORA and NIS2 apply, align the token-compromise classification and reporting path so one assessment feeds both regimes.

5. Indicators of compromise

The primary source publishes no atomic IOC list; the indicators below come from the Talos affiliate research and are single-sourced. Verify before enforcement.

domain  dashboard-bl[.]pamconj[.]com
domain  spx[.]pamconj[.]com
domain  clear90489058903-document[.]workers[.]dev
url  hxxps[:]//mononapfpcom[.]sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc

Behavioural indicators

6. Detection

The sources give no file artefacts, so no YARA rule is possible. The behavioural and log indicators support Sigma rules.

title: Device code flow authentication followed by device registration
id: 8f3c1a52-6d47-4b8e-9c21-0f5a8d2b7e34
status: experimental
description: >
  Detects a successful OAuth device code flow authentication followed within a
  short window by a new device registration, matching the EvilTokens persistence
  pattern of minting a Primary Refresh Token shortly after token theft.
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/
  - https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/
author: Adverse Trace
date: 2026-09-22
logsource:
  product: microsoft365
  service: audit
detection:
  selection_signin:
    eventSource: 'AzureActiveDirectory'
    eventName: 'Sign-in activity'
    authenticationRequirement: 'deviceCode'
    resultStatus: 'Success'
  filter_known_devices:
    deviceId: ''
  condition: selection_signin and not 1 of filter_*
  timeframe: 15m
falsepositives:

  - Legitimate Teams room or limited-interface device sign-ins (scope exceptions to those resource accounts)
level: high

title: Inbox rule created after device code flow authentication
id: c4e9d7a1-3f52-4a6b-8e10-9d3f6c2a5b78
status: experimental
description: >
  Detects creation of an inbox rule shortly after a device code flow sign-in,
  matching the EvilTokens pattern of persistence rules that forward or delete
  messages to conceal actor activity.
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/
author: Adverse Trace
date: 2026-09-22
logsource:
  product: microsoft365
  service: exchange
detection:
  selection_rule:
    eventSource: 'Exchange'
    eventName: 'New-InboxRule'
  condition: selection_rule
  correlation:

    - eventSource: 'AzureActiveDirectory'
      eventName: 'Sign-in activity'
      authenticationRequirement: 'deviceCode'
      resultStatus: 'Success'

    - within: 24h
      same_user: true
falsepositives:

  - User-created legitimate inbox rules following a Teams device sign-in
level: high

7. Sources

• Microsoft Security Blog, Unmasking EvilTokens: Getting to the root of device code phishing, https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/, 2026-09-22
• The Register Security, UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites, https://www.theregister.com/security/2026/09/22/uk-cops-arrest-2-eviltokens-suspects-microsoft-seizes-50-phishing-kit-websites/5298317, 2026-09-22
• Cisco Talos, ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365, https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/, 2026-07-01
• The Register Security, EvilTokens device-code phishing kit totally more evil than we all thought, https://www.theregister.com/cyber-crime/2026/07/01/eviltokens-device-code-phishing-kit-totally-more-evil-than-we-all-thought/5265409, 2026-07-01
• The Hacker News, Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises, https://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.html, 2026-09-22
• BleepingComputer, ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit, https://www.bleepingcomputer.com/news/security/artoken-phaas-exposes-eviltokens-microsoft-365-phishing-toolkit/, 2026-07-01
• ESET WeLiveSecurity, EvilTokens: A phishing attack that doesn't steal your password, https://www.welivesecurity.com/en/cybercrime/eviltokens-phishing-doesnt-steal-password/, n/a

8. Adverse Trace position

We assess the residual risk to EMEA financial services clients as high despite the disruption, because the takedown removes the service, not the access: tokens and PRTs issued before 19 September remain valid until revoked, and the AI BEC pipeline was built to convert a compromised finance mailbox into payment-diversion fraud within days. The UK and France both appear in the observed victim concentration list, so EMEA exposure is established, not theoretical. Attribution to Storm-2992 is unconfirmed (no MITRE profile), and the ARToken affiliate infrastructure is single-sourced to Talos; we will not treat either as settled. We will track post-takedown reconstitution of the platform, since Microsoft's own assessment is that the model will outlive this instance, and we will issue updated guidance if affiliate infrastructure or new device code phishing campaigns re-emerge on the seized domains' replacements.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.