Actor Profile

EvilTokens (tracked by Microsoft as Storm-2992) is a Phishing-as-a-Service (PhaaS) platform that emerged in February 2026. The operation was administered by two suspects, aged 32 and 38, arrested in the U.K. (Canary Wharf and Nine Elms) following investigation by Microsoft's Digital Crimes Unit, Health-ISAC, law enforcement, and SpyCloud. EvilTokens was the first PhaaS platform to support device-code authentication at scale and offered AI-powered features for customizing phishing lures and analyzing compromised inboxes. The service was promoted via Telegram with pricing at $500/month or $1,500 one-time fee, targeting enterprise environments to enable sophisticated business email compromise (BEC) campaigns. The platform compromised over 12,000 Microsoft accounts across more than 10,000 organizations globally before infrastructure disruption in September 2026.

TTPs (Tactics, Techniques, Procedures)

EvilTokens specializes in device-code phishing, abusing Microsoft's legitimate OAuth 2.0 device-authorization flow designed for limited-input devices. The attack chain involves the threat actor initiating a device-code request, sending the code to victims via phishing lures that direct them to Microsoft's legitimate login portal for authentication, bypassing MFA protections to obtain authentication tokens. Post-compromise, the platform leverages Microsoft Graph API for organizational mapping and employs AI-powered tools to analyze mailbox content, searching for wire-transfer information, pending invoices, and executive correspondence to identify high-value targets for BEC operations. Evasion techniques include multi-stage redirects, PDF and HTML attachments, fake CAPTCHA pages, and traffic routing through compromised sites and legitimate cloud platforms (Vercel, Cloudflare Workers, AWS Lambda). The service provided 44 customizable phishing kits impersonating document-signing platforms, Microsoft services, cloud identity providers, invoicing systems, voicemail, and eFax services.

Targets & Patterns

EvilTokens focused overwhelmingly on enterprise environments, with approximately 97.5% of compromised accounts belonging to corporate domains. SpyCloud data identified over 8,708 compromised accounts across 6,585 corporate email domains in 79 countries. Targeted sectors include wholesale distribution, construction, financial services, real estate, higher education, and healthcare. Geographic targeting prioritized the United States (primary target), followed by Canada, Australia, the United Kingdom, and Saudi Arabia. The platform's AI-powered analysis capabilities enabled affiliates to identify high-value targets within breached organizations by analyzing mailbox content for executive correspondence, financial transactions, and sensitive business communications, facilitating targeted BEC campaigns rather than opportunistic credential theft.

Historical Context

EvilTokens emerged in February 2026 as the first PhaaS platform to support device-code authentication at scale, triggering a surge in device-code phishing adoption across the threat landscape. By April 2026, at least 10 phishing platforms had incorporated this capability. Following the September 2026 infrastructure disruption coordinated by Microsoft DCU, affiliates have already created clone platforms such as APToken, indicating the technique's continued viability. The operation represents an evolution in PhaaS offerings through integration of AI-powered features for lure customization and victim analysis, setting a precedent for automated, intelligence-driven phishing operations. The platform's disruption involved legal authority to seize active infrastructure but was not a complete takedown, with the threat remaining active though at reduced volume.

Defensive Recommendations

  • Disable device-code authentication (OAuth 2.0 device authorization flow) for organizational tenants where not operationally required, particularly for environments without smart TVs, printers, or conferencing equipment dependencies
  • Implement conditional access policies to block device-code authentication flows and monitor Azure AD sign-in logs for authentication method 'deviceCode' or sign-in events originating from unexpected device types
  • Deploy phishing-resistant authentication methods such as FIDO2 security keys or passkeys that cannot be bypassed through token theft or device-code flows
  • Monitor for suspicious OAuth consent grants and authentication patterns, including logins to unexpected applications, multiple device-code authentications in short timeframes, or Graph API queries for organizational structure mapping post-authentication
  • Implement email security controls to detect multi-stage redirects through cloud platforms (Vercel, Cloudflare Workers, AWS Lambda), PDF/HTML attachments with embedded links, and impersonation of document-signing or invoicing platforms in phishing lures