Microsoft's Digital Crimes Unit (DCU), operating in coordination with international law enforcement authorities, announced on Wednesday the successful seizure of core command-and-control (C2) domains and infrastructure hosting 'EvilTokens'. The illicit network operated as a specialized Phishing-as-a-Service (PaaS) platform marketed on cybercrime forums to compromise enterprise Microsoft 365 and cloud identity tenants.
Rather than harvesting static passwords through credential harvesting portals, EvilTokens abused the OAuth 2.0 Device Authorization Grant standard (a legitimate authentication mechanism originally designed for smart appliances and devices lacking standard web browsers). Attackers distributed spearphishing emails masquerading as urgent IT surveys or security policy notices, prompting victims to enter a unique device code at the authentic `microsoft.com/devicelogin` portal. Once the employee authenticated and approved their standard multi-factor authentication (MFA) challenge, valid OAuth access and Primary Refresh Tokens (PRT) were routed directly to the attacker's server infrastructure. This allowed adversaries to establish persistent, unauthorized session access for weeks without ever knowing the user's password or triggering recurring MFA prompts.
Forensic telemetry gathered by Microsoft revealed that more than 1,500 organizations across 40 countries had been targeted by EvilTokens campaigns during 2026. Following federal court orders, control of 68 malicious domains was transferred to Microsoft sinkholes, severing connectivity between phishing landing pages and illicit backend operator consoles.
Actionable Guidance for Security Teams
1. Restrict or Disable Device Code Authentication Flow: Disable the OAuth Device Code Grant flow within Microsoft Entra ID for all standard user profiles that do not require specialized hardware authentication. 2. Enforce Conditional Access Policies: Require enterprise-managed, compliant devices (Intune/Entra Hybrid Joined) for all cloud application access to prevent token replay from unmanaged endpoints. 3. Alert on Anomalous Device Code Sign-Ins: Configure SIEM detection rules monitoring Azure AD Sign-in logs for `authenticationProtocol: deviceCode` originating from untrusted autonomous systems (ASNs) or geolocations. 4. Revoke User Refresh Tokens Upon Suspicion: If token compromise is detected, execute immediate session termination across all active cloud sessions via PowerShell (`Revoke-MgUserSignSession`).
Evidence Rail
- Confirmed: Microsoft DCU published official legal filings and seizure records detailing infrastructure dismantlement.
- Reported: Cybersecurity researchers tracked thousands of high-velocity phishing lures leveraging EvilTokens templates.
- Unconfirmed: Formal criminal indictments against platform operators remain pending with federal law enforcement.
In Brief
- Microsoft DCU dismantled global EvilTokens platform providing Device Code phishing services to cybercriminals.
- Technique bypassed standard MFA by tricking authenticated users into granting persistent OAuth tokens.
- Administrators must restrict Device Code authentication in Entra ID and enforce compliant device policies.