Device code phishing: How EvilTokens worked and how to stop it
Blog post from WorkOS
Microsoft’s disruption of EvilTokens, a phishing-as-a-service operation linked to Storm-2992, highlighted how attackers can abuse the legitimate OAuth 2.0 device authorization grant to obtain tokens from victims who authenticate on real Microsoft pages. Active since February 2026, EvilTokens reportedly compromised more than 12,000 inboxes across over 10,000 organizations by generating device codes when victims clicked phishing links, allowing attackers to poll for approved tokens while victims completed normal password, MFA, or passkey authentication. The service sold a subscription-based toolkit with lure templates, mailbox analysis, AI-assisted fraud preparation, and post-compromise techniques including device registration, inbox-rule creation, and organizational reconnaissance. Because device-code phishing exploits a user’s approval of an attacker-initiated session rather than credential theft or a fake site, phishing-resistant MFA alone does not prevent it. Organizations and product teams that rely on device-code login for CLIs and similar tools are advised to make approval screens clearly identify the application and require code confirmation, use short authorization and token lifetimes, allow customers to disable or restrict device sign-in, monitor device-flow events independently, and enforce server-side session checks for sensitive actions to limit the effects of delayed token revocation.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.