As reported by BleepingComputer, Microsoft's Digital Crimes Unit led a coordinated takedown of the EvilTokens PhaaS operation — a platform that compromised over 12,000 Microsoft accounts across 10,000+ organizations worldwide. The disruption included arrests of two suspected operators in the U.K. and infrastructure seizure. But the underlying attack technique — device code phishing — remains a growing threat that defenders must address urgently.

Threat Alert: As reported by BleepingComputer, Microsoft's Digital Crimes Unit led a coordinated takedown of the EvilTokens PhaaS operation — a platform that compromised over 12,000 Microsoft accounts across 10,000+ organizations worldwide.

Device Code Phishing: The MFA Bypass Hiding in Plain Sight

The EvilTokens platform represents a maturation point for a technique that's been gaining traction since at least 2023. Device code phishing abuses the OAuth 2.0 device authorization flow — a legitimate mechanism designed for input-constrained devices like smart TVs and printers — to trick users into completing authentication on behalf of an attacker-controlled session.

What makes this particularly insidious: from the user's perspective, they're authenticating to a genuine Microsoft login page. From the platform's perspective, the token is valid, MFA was satisfied, and the session appears legitimate. The attacker walks away with a refresh token that persists across sessions — sometimes for days or weeks.

The fact that EvilTokens was the first platform to industrialize this at scale — and that by April 2026, at least ten competing PhaaS platforms had added device code capabilities — signals this is now standard infrastructure in the criminal ecosystem, not a niche technique.

AI as a Force Multiplier for BEC

The platform's AI-powered features for customizing phishing lures and triaging compromised inboxes for high-value targets deserve specific attention. This is a clear example of AI democratizing capabilities that previously required human analysts — automatically identifying executive accounts, financial correspondence, and wire transfer fraud opportunities from thousands of compromised mailboxes.

SpyCloud's recaptured data showing 8,708 accounts across 6,585 corporate domains in 79 countries illustrates the global footprint. The sectors hit — financial services, construction, healthcare, higher education, real estate — align with traditional BEC targeting: organizations with large transaction volumes and variable cybersecurity maturity.

What This Takedown Doesn't Fix

Infrastructure seizures and arrests are valuable, but they're interim measures. The operators were released on bail. Competing platforms continue offering device code phishing. And the fundamental vulnerability — that the device code flow trusts the user to complete authentication without any device binding — remains unaddressed at the protocol level.

Organizations that assume their MFA investment protects them from account takeover are operating on a false premise for this attack class. Device code phishing bypasses MFA entirely because the user completes the MFA challenge themselves — the attacker just needs them to enter the code on a session the attacker initiated.

Shield53 Recommendations

Shield53 Recommendations
Restrict device code flow usage: In Microsoft Entra ID, review and limit which applications can use the device code flow. Disable it for applications that don't require it. Monitor conditional access policies for device code authentication grants.
Implement conditional access controls: Require managed or compliant device status for authentication. Block authentication from unknown devices or untrusted locations. Consider blocking device code flow for non-admin users entirely if feasible for your environment.
Train users on device code phishing specifically: Standard phishing awareness doesn't cover this vector. Users need to understand that being asked to visit a Microsoft login page and enter a code — outside of an expected device setup context — is a red flag.
Monitor for suspicious OAuth grants: Set up alerts for new refresh token issuance from unfamiliar IPs or for applications that shouldn't be using device code flow. Hunt for token acquisition events that don't correspond to legitimate device enrollment.
Hunt for post-compromise persistence: If your organization was potentially affected, search mailboxes for auto-forwarding rules, inbox rules that hide messages, and new delegate permissions — classic BEC persistence mechanisms.
Review session token lifetimes: Shorten refresh token lifetimes where possible. Implement continuous access evaluation (CAE) to revoke sessions when conditions change. Enforce session expiration for sensitive applications.

The EvilTokens disruption is a meaningful win, but the industry should expect device code phishing to persist and evolve. The technique is too effective and too easy to deploy for criminal operators to abandon it. Defenders need protocol-level awareness, targeted user education, and monitoring strategies that assume MFA alone is insufficient against this attack class.