EvilTokens OAuth Phishing Reportedly Compromises 340+ Microsoft 365 Organizations
Summary
The article says EvilTokens used OAuth consent phishing to obtain refresh tokens from users at more than 340 Microsoft 365 organizations. The tokens could evade MFA protections and survive password resets; recommended defenses include grant monitoring and token-level re
Key points
- EvilTokens, a phishing-as-a-service platform, reportedly affected more than 340 Microsoft 365 organizations across five countries within five weeks of launching in February 2026.
- Users were directed to enter a short code at microsoft[.]com/devicelogin and approve OAuth consent; the article says this gave attackers refresh tokens scoped to mail, files, calendars, and contacts.
- The article says the tokens could remain valid for weeks or months and survive password resets; explicit token revocation or a policy requiring re-consent could close access.
- “Toxic combinations” can form when separate app grants connect access across SaaS applications through one identity, beyond the risk view of any single app owner.
- The article identifies MCP servers, AI agents, and integrations as potential bridges that can acquire scoped access through consent-like trust mechanisms.
- Recommended checks include continuously inventorying OAuth grants, reviewing old grants and cross-app identities, monitoring consent events, and revoking tokens individually.
Article Details
- Topic
- OAuth consent phishing using EvilTokens to steal persistent Microsoft 365 refresh tokens and bypass MFA