TL;DR
- EvilTokens – a top PhaaS platform that first commoditized the device code phishing technique – was disrupted through a collaborative public-private partnership led by Microsoft.
- SpyCloud’s dataset of recaptured phished data, which shows over 8,700 accounts successfully compromised by EvilTokens, was critical in supporting this disruption.
- EvilTokens is part of a larger trend in PhaaS to use real-time session capture techniques like device code phishing to compromise enterprise cloud services and SSO accounts.
- Now that many modern enterprises rely heavily on cloud SaaS, identity is the new perimeter for corporate IT environments. These PhaaS platforms can bypass critical identity protection tools like MFA to gain and maintain persistent access to important enterprise cloud accounts. For EvilTokens, we can observe that the average victim is an enterprise user in North America.
SpyCloud recently supported a coordinated disruption of the EvilTokens commodity Phishing-as-a-Service (PhaaS) platform led by Microsoft’s Digital Crimes Unit (DCU) and the Health-ISAC, in coordination with law enforcement and other private industry partners. EvilTokens is a popular PhaaS platform that enables criminals to gain and maintain access to Microsoft accounts via device code phishing.[1] The EvilTokens platform also uses LLMs to analyze and monitor compromised inboxes for messages relevant to business email compromise (BEC) attacks.
SpyCloud supported the disruption action by contributing recaptured data from over 8,700 unique EvilTokens victims. This recaptured data provided evidentiary support in the legal actions taken to seize active EvilTokens infrastructure, as well as support Microsoft in identifying, notifying, and remediating compromised customer accounts.
What is EvilTokens?
EvilTokens is a commodity PhaaS platform which has been active since at least February 18, 2026. It was the first PhaaS platform on the market to offer device code phishing, which exploits a legitimate OAuth 2.0 login flow designed to sign into input-constrained devices.[2] In device code phishing, the attacker initiates an OAuth 2.0 device authorization flow against Entra ID, then tricks the victim into entering the resulting user code at Microsoft’s legitimate device login page. The victim authenticates and satisfies MFA, and the attacker, polling the token endpoint with the corresponding device code, receives access and refresh tokens for the victim’s account.
This technique allows attackers to establish and maintain persistent access to accounts regardless of MFA or other account protections, as all authentication workflows are completed within the legitimate Microsoft ecosystem. Refresh tokens are long-lived, with a 90-day inactivity window and no fixed maximum age, so regular use extends access indefinitely. A password reset invalidates them in cloud-managed tenants, but access tokens persist until expiry, hybrid and federated configurations can fail to propagate revocation, and any MFA method, device, or application registration the attacker added in the interim survives untouched.
EvilTokens also offers a feature-rich panel full of additional tools, including an AI-enabled email analysis and monitoring pipeline. As Sekoia noted in a recent blog, the platform automatically pulls up to 5,000 recent emails using the Microsoft Graph API, analyzes the victim’s environment, identifies the best opportunities for BEC attacks, and even crafts custom BEC email messages. The platform also has built-in tools for anti-analysis, detection evasion, translation for over 20 languages, and special features to detect and use global administrator accounts. In a Microsoft O365 environment, a global administrator account can grant itself access to every other mailbox in the tenant, create new accounts, and change passwords for any user.
EvilTokens Victimology
Based solely on SpyCloud’s collection of recaptured data from EvilTokens, we can see at least 8,708 unique victim accounts with a device code token capture, across 6,585 unique corporate email domains spanning 79 countries, with the first captures occurring within SpyCloud’s visibility on February 18, 2026. The overwhelming majority of victims were based in the United States, followed by Canada, Australia, the United Kingdom, Saudi Arabia, and India. EvilTokens’ heavy targeting in North America is consistent with enterprise-targeted financial crimes such as BEC, data-theft extortion, and ransomware.
Geographic breakdown of EvilTokens victims.
Successful session compromises also overwhelmingly occurred during normal business hours in North America, Monday through Friday. Weekdays averaged about 7x as many successful session captures as days on the weekend, and only 5.4% of victims had their sessions captured on a Saturday or Sunday. Volume of session compromises also peaked during the regular North American workday (9am – 5pm in the US Eastern timezone).
Distribution of successful EvilTokens session captures by day of the week.
Distribution of successful EvilTokens session captures by time of day.
Out of almost nine thousand accounts that we observed successfully compromised by EvilTokens, only 216 accounts were for free webmail services – the other 97.5% belonged to enterprise domains. Many corporate domains experienced more than one successful device code token capture, and the 35 most heavily compromised domains accounted for 706 unique account compromises.
The compromise of multiple users within the same Microsoft tenant environment is directly supported by some of the key features in the PhaaS platform. EvilTokens customers can pivot on a successfully compromised account to target more significant users in the same domain – either those who facilitate large financial transactions or that tenant’s global administrator. If you think of an Entra session capture as the initial access vector in a cloud identity compromise, then you can think of these features as tools for lateral movement and privilege escalation. It’s also relevant to note here that Microsoft Entra doesn’t just provide access to webmail, it also acts as a SSO provider for other enterprise cloud services.
EvilTokens Customer Breakdown
Based on our visibility, we are also able to cluster successful device code token captures into different EvilTokens customers – other criminals who purchased EvilTokens subscriptions and used the platform to compromise victims’ accounts. From this data we can see a few interesting trends. For one, we can see that most customers were geographically specialized. On average, the 12 highest volume EvilTokens customers draw 74% of their victims from a single country. This implies that these customers ran targeted campaigns to compromise specific types of enterprise victims, instead of relying on more opportunistic distribution methods like malvertising.
Data from successful account phishing by the top 12 highest volume customers of EvilTokens.
Finally, we can see that a small group of power users accounted for the bulk of EvilTokens compromises. The top 10 most active EvilTokens customers accounted for 60% of the total unique victims in our recaptured data. This tapers off quite quickly – the top 25 customers account for 85% of the unique victims.
Graph showing the share of victims by EvilTokens customer account.
Final takeaways
EvilTokens is part of a larger trend in PhaaS to use real-time session capture techniques like device code phishing, Adversary-in-the-Middle (AiTM), and Browser-in-the-Middle (BiTM) to compromise enterprise cloud services and SSO accounts. For these kits, enterprises are the primary target; in our recaptured EvilTokens data, 97.5% of compromised accounts were enterprise accounts. While this collaborative disruption of EvilTokens will have a positive impact in disrupting this activity, there are still multiple other commodity PhaaS platforms using this tactic to compromise enterprises.
Even after infrastructure takedowns, exposed credentials and session tokens remain exploitable. Organizations should:
- Monitor for exposed enterprise credentials and compromised session and refresh tokens in criminal ecosystems
- Invalidate active session cookies when compromise is suspected
- Disable device-code authorization by default for most enterprise users
- Deploy phishing-resistant authentication methods (FIDO2, hardware tokens)
- Implement continuous identity exposure monitoring
- Monitor for anomalous login geography and proxy abuse
Discover what cybercriminals know about your business and your customers – and how those insights help you protect digital identities and prevent targeted attacks.
[1] This tactic is part of a larger category of identity attacks called session hijacking, see: https://spycloud.com/glossary/session-hijacking/.
[2] While device code phishing has been an established method of gaining access to a Microsoft O365 account since at least 2020, EvilTokens was the first widely-available commodity PhaaS platform to include the feature, which quickly gained prevalence in other commodity PhaaS platforms.
Keep reading
