TLDR Tech / InfoSec
New widespread EvilTokens kit: device code phishing as-a-service – Part 1
EvilTokens is a new Phishing-as-a-Service platform that weaponizes Microsoft's OAuth 2.0 Device Authorization Grant flow, tricking victims into entering attacker-controlled user codes at the legitimate microsoft.com/devicelogin endpoint to harvest access and refresh tokens for Microsoft 365 account takeover. The kit automates post-compromise token conversion to Primary Refresh Tokens (PRTs), enabling persistent MFA-bypassing SSO access across Outlook, SharePoint, OneDrive, Teams, Microsoft Graph, and Azure, with over 1,000 affiliated phishing domains detected across Cloudflare Workers infrastructure by March 23. Defenders should monitor for the distinctive X-Antibot-Token HTTP header, block domains matching affiliate Cloudflare Workers patterns, and hunt via urlscan.io using requests to /api/device/start and /api/device/status/, with YARA rules and IOCs published in the Sekoia Community GitHub repository.
Read the full story