EvilTokens phishing kit abused device code sign-in to compromise 12,000 inboxes

More than 12,000 inboxes across more than 10,000 organizations works out to roughly 1.2 compromised mailboxes per organization on the reported floors ^[3][24]. That shape tells a defender what the platform's customers were buying: a foothold inside a company. Microsoft says stolen tokens were used for email exfiltration and persistence, often through malicious inbox rules that conceal communications, and in some cases to grant new devices access to a victim's inbox ^[5][6].

The foothold pays because of what a valid token opens. Microsoft says EvilTokens let operators run Microsoft Graph reconnaissance to map organizational structure and permissions, supporting continued access and potential lateral movement while the tokens stay valid ^[9]. It also let them point AI assistants at the mailbox they had taken and write the next lure out of the mail already sitting in it ^[8].

Device code authentication exists for hardware that cannot run an interactive sign-in: smart TVs, printers, Teams devices, conferencing devices ^[16]. The user reads a short code off that device and types it into a browser somewhere else ^[17]. Microsoft wrote that the flow "introduces a security tradeoff", because authentication completes on a separate device and the session that starts the request is not strongly bound to the user's original context ^[18][19]. Attackers use that decoupling to get around MFA ^[20].

The screen a victim approves is Microsoft's own. Microsoft says actors dress the legitimate device code approval up as something else the user supposedly has to do ^[21]. Awareness training in that position asks an employee to work out who triggered a prompt that Microsoft generated. The recommendation in the post is a layered approach blending technical controls with user awareness, plus Defender detection and hunting guidance and resources on mail flow rules, spoof protections and third-party connectors ^[22][23]. Microsoft did not recommend disabling or conditionally gating device code sign-in ^[26].

Gating it has a cost. A tenant that blocks device code sign-in also blocks any conferencing hardware or printer in its estate that authenticates that way ^[16]. Inbox rules are the cheaper side of the same problem, and they are the artifact Microsoft names for persistence ^[5].

Microsoft says token-targeting phishing has become far more common and industrialized over the last several years as organizations adopted MFA ^[10]. MFA closed password replay, and the kits moved to the tokens. The delivery side moved with it: 44 lure themes including invoices, requests for proposals and shared files, carried by malicious URLs, PDF attachments and HTML files through a multi-stage pipeline built to bypass traditional email gateways and endpoint security ^[12][11].

Observed victims concentrated in the United States, Canada, the United Kingdom, Australia, India and France, across wholesale distribution, construction, financial services, real estate, higher education and healthcare ^[14][13]. Microsoft's Digital Crimes Unit, working with partners, facilitated a coordinated disruption of the infrastructure used to operate the service ^[15]. Microsoft Threat Intelligence tracks the actor behind its development and support as Storm-2992 ^[7]. About seven months separate the platform's emergence in February 2026 from the September 22 post ^[1][25][27]. The disruption removed a seller, and the flow still finishes authentication on a second device, the property EvilTokens used.