Microsoft Disrupts EvilTokens Device Code Phishing Service

The EvilTokens operation exploited Microsoft's device code authentication flow — a legitimate feature designed for input-constrained devices — to trick users into granting persistent OAuth tokens to attacker-controlled applications. Once a token is captured, attackers gain long-term access to Microsoft 365 accounts without needing the user's password or MFA code, effectively bypassing standard credential protections. This matters because phishing-as-a-service platforms lower the technical barrier for attackers, enabling even unsophisticated threat actors to launch enterprise-grade credential theft campaigns at scale. Microsoft's takedown of 50 websites and 150+ domains highlights how critical infrastructure disruption is becoming a key defensive lever, but organizations cannot rely solely on vendor intervention to protect their users.