TLDR Tech / InfoSec
Inside an AI‑enabled device code phishing campaign
Microsoft Defender researchers tracked a large-scale device code phishing campaign powered by the EvilToken Phishing-as-a-Service toolkit. Attackers used Railway.com to spin up short-lived Node.js polling nodes and generated device codes dynamically at the time of click, which resolved the 15-minute expiration issue. Emails were tailored to each target role, such as invoices, RFPs, and manufacturing workflows, to boost interaction rates. After capturing tokens, attackers used Microsoft Graph to map organizational structures and then focused on financial and executive accounts for email exfiltration.
Read the full story