EvilTokens Phishing Kit Uses Microsoft Device Codes to Target Accounts
Summary
Sekoia observed EvilTokens campaigns using document-based lures and Microsoft’s device authorization flow to obtain account tokens. The phishing-as-a-service kit supports BEC automation, and Sekoia shared IoCs and YARA rules for defenders.
Key points
- EvilTokens is a phishing-as-a-service kit sold via Telegram and under active development.
- Sekoia observed lures in PDF, HTML, DOCX, XLSX, and SVG documents that direct victims to phishing templates.
- The lures impersonate business services and prompt victims to authenticate through Microsoft's legitimate device login flow.
- The technique can give attackers access and refresh tokens, enabling access to email, files, Teams, and cross-service SSO impersonation.
- Sekoia reported campaigns with global reach and identified the United States, Canada, France, Australia, India, Switzerland, and the UAE among the most affected countries.
- Sekoia provided indicators of compromise and YARA rules to help defenders identify or block EvilTokens activity.
Article Details
- Event Type
- Phishing-as-a-service kit enabling Microsoft device code phishing
- Impact
- Successful attacks can give operators access and refresh tokens, enabling persistent access to victims’ email, files, and Teams data, as well as SSO impersonation and business email compromise.
MITRE ATT&CK
Threat Actors
ShinyHuntersThe article identifies this data extortion group as among those that have used device code phishing.Storm-237The article lists this tracked group among those reported to have used device code phishing.TA2723The article lists this tracked group among those reported to have used device code phishing.UNK_AcademicFlareThe article lists this tracked group among those reported to have used device code phishing.UTA032The article lists this tracked group among those reported to have used device code phishing.UTA0355The article lists this tracked group among those reported to have used device code phishing.
Vendors
Products
Countries
AustraliaSekoia researchers examined EvilTokens’ infrastructure and uncovered campaigns with a global reach, the most affected countries being the United States, Canada, France, Australia, India, Switzerland, and the UAE.CanadaSekoia researchers examined EvilTokens’ infrastructure and uncovered campaigns with a global reach, the most affected countries being the United States, Canada, France, Australia, India, Switzerland, and the UAE.FranceSekoia researchers examined EvilTokens’ infrastructure and uncovered campaigns with a global reach, the most affected countries being the United States, Canada, France, Australia, India, Switzerland, and the UAE.IndiaSekoia researchers examined EvilTokens’ infrastructure and uncovered campaigns with a global reach, the most affected countries being the United States, Canada, France, Australia, India, Switzerland, and the UAE.SwitzerlandSekoia researchers examined EvilTokens’ infrastructure and uncovered campaigns with a global reach, the most affected countries being the United States, Canada, France, Australia, India, Switzerland, and the UAE.UAESekoia researchers examined EvilTokens’ infrastructure and uncovered campaigns with a global reach, the most affected countries being the United States, Canada, France, Australia, India, Switzerland, and the UAE.United StatesSekoia researchers examined EvilTokens’ infrastructure and uncovered campaigns with a global reach, the most affected countries being the United States, Canada, France, Australia, India, Switzerland, and the UAE.
Industries
financePhishing lures use documents with QR codes or links impersonating services like DocuSign or Adobe to target finance, HR, logistics, and sales staff.logisticsPhishing lures use documents with QR codes or links impersonating services like DocuSign or Adobe to target finance, HR, logistics, and sales staff.SalesPhishing lures use documents with QR codes or links impersonating services like DocuSign or Adobe to target finance, HR, logistics, and sales staff.