As reported by The Hacker News, Microsoft's Digital Crimes Unit has dismantled EvilTokens — a device-code phishing-as-a-service platform responsible for approximately 12,000 inbox compromises — with two suspects arrested in London. What sets this operation apart isn't just the scale; it's the degree to which AI was woven into every stage of the attack lifecycle.

Threat Alert: As reported by The Hacker News, Microsoft's Digital Crimes Unit has dismantled EvilTokens — a device-code phishing-as-a-service platform responsible for approximately 12,000 inbox compromises — with two suspects arrested in London.

Why Device Code Phishing Is a Blind Spot

The EvilTokens platform abused the OAuth 2.0 device authorization grant — a legitimate flow designed for input-constrained devices like smart TVs and IoT hardware. The attacker initiates the flow server-side, receives a device code, and then socially engineers the victim into entering that code at a legitimate Microsoft endpoint (microsoft.com/devicelogin). The victim authenticates normally, but the resulting tokens are issued to the attacker's client session.

This matters because it sidesteps most traditional anti-phishing controls. The victim visits a real Microsoft domain. No credential theft occurs in transit. MFA may be satisfied. Conditional access policies may pass. Yet the attacker walks away with valid access and refresh tokens — often with long lifetimes.

The AI Accelerant

The most concerning innovation wasn't the phishing mechanism itself — device code abuse has been documented since at least 2022. The escalation is the integrated AI chatbot that analyzed compromised mailboxes to surface high-value fraud targets: payment approvers, trusted vendor relationships, invoice chains. It could then draft contextually accurate impersonation messages using the victim's own communication patterns.

This compresses what was historically a multi-week BEC reconnaissance cycle into hours. The operator no longer needs to manually read thousands of emails or understand business context — the AI handles triage and prescribes the next action. That's a fundamental lowering of the barrier to entry for sophisticated financial fraud.

The convergence of OAuth token theft and AI-driven mailbox analysis means defenders can no longer treat email security and identity security as separate domains.

Who Is at Risk

Any organization using Microsoft Entra ID (formerly Azure AD) with device code flow enabled is exposed. High-risk sectors include:

The AI Accelerant
Healthcare — Health-ISAC's involvement signals active targeting of healthcare organizations
SMBs — Less likely to have conditional access policies restricting device code flow
Organizations with legacy or IoT integrations — These may require device code flow, making blanket disabling impractical

Shield53 Recommendations

Immediate Actions

  • Audit device code flow usage: Review Entra ID sign-in logs for device code authentication events (interactive code flow). Filter for unusual source IPs, device fingerprints, or tokens issued outside expected geographies. Microsoft's sign-in logs expose the authentication method field for this.
  • Hunt for persistence indicators: Search for recently created inbox rules with suspicious forwarding, deletion, or move-to-folder actions — especially rules targeting messages containing keywords like "invoice," "payment," "wire," or "ACH."
  • Revoke active refresh tokens: For any account showing device code authentication, revoke all sessions and force re-authentication. In Entra ID, use Revoke-AzureADUserAllRefreshToken or the Graph API equivalent.

Hardening

  • Restrict device code flow via conditional access: If your organization doesn't require the device code grant, disable it entirely. If it's needed for specific integrations, scope conditional access policies to require compliant devices or trusted locations for the device code flow specifically.
  • Implement token protection policies: Entra ID's Continuous Access Evaluation (CAE) and session token revocation can shorten the blast radius of stolen tokens.
  • Deploy phishing-resistant MFA: Number-matching push notifications and FIDO2 hardware keys don't prevent the device code flow, but they reduce the broader attack surface and force attackers toward more detectable methods.
  • Monitor for new device registrations: EvilTokens was observed granting new devices access to victim inboxes. Alert on unexpected device enrollment events, especially from unfamiliar locations or device types.

Strategic Considerations

This takedown illustrates a broader trend: AI is not just a defensive tool — it's being productized for attackers. Security teams should expect that the next generation of PhaaS platforms will include AI-assisted targeting, message drafting, and even response handling for intercepted conversations. Investment in behavioral analytics, UEBA, and token lifecycle monitoring will increasingly determine whether organizations catch these intrusions before financial fraud occurs — or discover them when the wire transfer is already gone.