Microsoft takes down EvilTokens, an AI phishing kit that hit 12,000 inboxes
The kit got people to approve a sign-in on Microsoft's real login page, then used AI to read the mailbox and pick the fraud target. Here is how the device-code trick works, and how to switch it off.
No fake login page. Victims typed a code into Microsoft's real one, passed MFA, and let the attacker in.
Microsoft's Digital Crimes Unit said on September 22, 2026 that it had disrupted EvilTokens, a phishing kit sold on Telegram for a $1,500 setup fee plus $500 a month. Microsoft's announcement says the service compromised more than 12,000 inboxes across more than 10,000 organizations. Under a US federal court order, Microsoft seized 50 websites and disabled more than 150 other domains.
Microsoft and Health-ISAC filed the case in the Eastern District of Virginia on September 15. London's Metropolitan Police arrested two men earlier this month, and both are on bail, The Record reported. Microsoft calls this the Digital Crimes Unit's 40th court-authorized disruption, and its first against an end-to-end AI-enabled crime service. Cloudflare, Coinbase, OpenAI and TRM Labs were among the partners.
The trick: a real login page
EvilTokens did not fake a sign-in page. It abused the OAuth device code flow, the flow built for TVs and command-line tools that cannot open a browser. The attacker asks Microsoft for a device code, then sends the victim a lure to enter it at Microsoft's genuine device login page. The victim signs in, passes MFA, and approves. The tokens go to the attacker's session. Microsoft's technical write-up tracks the developer as Storm-2992, active since February 2026.
Because the attacker holds tokens, not a password, a password reset does not end the session. Help Net Security notes that access can survive until the tokens are revoked, and that device code phishing is still active after the takedown.
Where the AI came in
Once inside, the kit summarized mailboxes, mapped who held which role, picked targets for invoice fraud, and drafted impersonation emails, using Microsoft Graph for reconnaissance. That is the part Microsoft is highlighting. Business email compromise used to need a person to read the inbox and find the finance contact. Here the software did it. CyberScoop reported that Coinbase traced about $1.1 million in revenue to the operators through June.
Why a build studio cares
Device code sign-in is allowed in a Microsoft 365 tenant unless a Conditional Access policy blocks it, and most staff never need it. Identity is part of the governance pass in our audits: who can sign in, from where, and through which flows. The checks here are concrete. Block device code flow for everyone except a named group that needs it. Alert on device code sign-ins. Make sure the incident runbook revokes sessions and refresh tokens, not just passwords. A takedown removes one kit. The flow it abused is still open in every tenant that did not close it.
Next step: read Microsoft's technical write-up for its detection guidance. If nobody on your team knows whether device code sign-in is allowed in your tenant, write to us at hello@gattyworks.com.