EvilTokens Turns Microsoft Sign-Ins Into a Gateway for AI-Driven Corporate Email Fraud

EvilTokens is a sophisticated phishing kit that abuses Microsoft’s device code authentication process to give attackers access to corporate email accounts without ever stealing a victim’s password. First observed in February 2026, the toolkit deceives users into authorizing a legitimate Microsoft login request initiated by the attacker, effectively handing over access tokens through a trusted sign-in mechanism.

Victims are typically targeted through urgent-looking emails referencing unpaid invoices, shared documents, signature requests, or expiring passwords. These messages direct recipients to a phishing page displaying a device code and instructions to continue the sign-in process.

At first glance, the request appears completely legitimate. Microsoft researchers have linked EvilTokens to the threat group Storm-2992, noting that the toolkit has significantly expanded the scale and effectiveness of business email compromise (BEC) operations.

According to Microsoft, campaigns leveraging EvilTokens have resulted in the compromise of more than 12,000 mailboxes across over 10,000 organizations worldwide. Impacted industries include finance, construction, healthcare, and education, with the highest concentration of victim activity observed in the United States, Canada, the United Kingdom, Australia, India, and France.

While earlier reports highlighted EvilTokens as a rapidly growing phishing-as-a-service platform, new research demonstrates how access gained through the kit is being used to facilitate increasingly sophisticated fraud schemes.

Weaponizing Microsoft’s Device Code Authentication

Microsoft originally designed device code authentication for devices that cannot easily display a traditional login page. Users simply enter a short code into a browser to approve access. EvilTokens exploits this workflow by reversing the trust model: instead of the user initiating the authentication request, the attacker does, then tricks the victim into completing it.

When a target visits the phishing page, the kit generates a fresh device code and can automatically copy it to the clipboard while directing the victim to Microsoft’s genuine sign-in portal. Because the authentication page is legitimate, many users incorrectly assume the request is safe.

However, the authenticity of the login page does not verify who initiated the authentication session. As the victim proceeds through password entry, multifactor authentication, or session approval, automated systems controlled by the attacker continuously monitor the request. Once authorization is granted, the attacker’s session immediately receives valid access tokens, eliminating the need to capture passwords directly.

Microsoft says operators frequently use the resulting access to read emails, search for invoices and payment information, and launch additional attacks against colleagues, customers, suppliers, and business partners using the compromised account.

AI Enhances the Effectiveness of Email Fraud

One of EvilTokens’ most concerning capabilities is its integration of artificial intelligence to improve fraud operations after an account has been compromised.

The kit can analyze mailbox contents, identify key personnel such as executives, finance teams, and administrators, and generate customized phishing emails tailored to an individual’s role and responsibilities. AI-powered analysis also helps attackers understand organizational structures and business relationships, enabling highly targeted follow-on attacks.

This dramatically increases the value of a compromised account. Instead of sending generic scam messages, threat actors can study genuine conversations and craft payment requests that blend seamlessly into existing business communications. The result is a more convincing and effective form of business email compromise that is far more difficult for employees to detect.

Commercialized Cybercrime Platform

EvilTokens is marketed through Telegram as a subscription-based cybercrime service. Access reportedly costs $1,500 upfront, followed by a $500 monthly fee. Customers receive access to a management panel featuring dozens of phishing templates, redirection options, and victim-tracking capabilities.

The platform lowers the barrier to entry for cybercriminals by providing a ready-made infrastructure that eliminates the need to build phishing components from scratch.

Operators also employ several evasion techniques, including hiding malicious links within images, using multi-stage redirection chains, and displaying fake verification checks before presenting victims with the authentication prompt. Microsoft reported observing thousands of short-lived automation nodes supporting these campaigns, making it difficult for defenders to identify the broader infrastructure based solely on phishing domains.

Maintaining Access and Evading Detection

After gaining initial access, attackers often take steps to ensure persistence. Common techniques include creating inbox rules that automatically hide security alerts and sensitive correspondence or registering additional devices to maintain long-term access.

Microsoft observed cases where attackers enrolled new devices within just ten minutes of compromising an account. This rapid post-compromise activity increases the likelihood of successful invoice fraud, executive impersonation, and other financially motivated attacks.

Defensive Measures

Microsoft recommends disabling device code authentication wherever it is not operationally required and applying strict controls to environments where it must remain enabled.

Organizations should educate employees never to approve authentication codes they did not personally request and remain vigilant for unusual sign-in activity, unexpected device registrations, and newly created mailbox rules. Payment and financial requests should always be verified through independent communication channels.

If an account compromise is suspected, security teams should immediately revoke refresh tokens, investigate mailbox activity, review registered devices, and inspect inbox rules. Microsoft also notes that active access tokens may remain valid for up to an hour after standard session revocation. Temporarily disabling the affected account can provide faster containment while incident responders assess the full scope of the breach.