Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises

The EvilTokens service exploited the OAuth device-code authentication flow — a legitimate mechanism designed for input-limited devices — to trick users into granting persistent access tokens to attackers without ever capturing a password. Once tokens were harvested, an embedded AI chatbot autonomously analyzed victim inboxes, mapped trusted relationships, and generated highly convincing impersonation messages to propagate fraud further. This attack demonstrates that modern phishing has evolved beyond credential theft into AI-assisted, token-based account takeover that bypasses MFA entirely. The scale of 12,000 compromised inboxes underscores how quickly automated, platform-as-a-service cybercrime tools can amplify a single attacker's reach. Organizations that rely solely on password-based or traditional MFA defenses are increasingly exposed to token-hijacking techniques.