Affected Systems

Organizations worldwide using Microsoft 365 and OAuth device code authentication. Over 12,000 inboxes compromised across 10,000+ organizations since February 2026. Highest impact in wholesale distribution, construction, financial services, real estate, higher education, and healthcare sectors. Geographic concentration in US, Canada, UK, Australia, India, and France.

Exploitation Status

Active exploitation confirmed. EvilTokens operated as a Phishing-as-a-Service platform from February 2026 until Microsoft Digital Crimes Unit disrupted infrastructure in coordination with partners. Platform provided AI-assisted phishing lures, 44 prebuilt email themes, and automated token theft capabilities. Threat actor tracked as Storm-2992.

Business Impact

EvilTokens enabled large-scale business email compromise through device code phishing that bypasses traditional MFA protections. Stolen tokens grant persistent access to victim inboxes, enable email exfiltration, allow creation of malicious inbox rules, and permit Microsoft Graph reconnaissance for lateral movement. Multi-stage delivery pipeline designed to evade email gateways and endpoint security. Infrastructure disruption reduces immediate threat, but similar PhaaS platforms and copycat services remain a concern.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block OAuth device code authentication flow organization-wide unless specifically required for Teams devices or similar hardware; if needed, scope exceptions to specific Teams device resource accounts only
  • Exclude Device Registration Service resource from Conditional Access policies where device code flow exceptions are configured
  • Review Microsoft 365 inbox rules across the organization for suspicious forwarding, deletion, or move-to-folder rules created since February 2026
  • Deploy Microsoft Defender XDR detections provided in the advisory and execute hunting queries to identify EvilTokens-related activity in tenant logs
  • Configure mail flow rules and enforce spoof protections in Microsoft 365 to block phishing emails using the 44 known EvilTokens themes (invoices, RFPs, shared files)
  • Audit OAuth token grants and revoke suspicious tokens, particularly those issued via device code flow, and review registered devices for unauthorized access