EvilTokens Uses Browser-Decrypted Phishing to Gain Microsoft 365 Account Access
Summary
EvilTokens hides phishing content with AES-GCM encryption and uses Microsoft’s device login flow to gain account access. The analysis traces its browser requests and shows how investigators can uncover related activity.
Key points
- EvilTokens encrypts its landing-page HTML with AES-GCM, so static URL and network checks may miss the content shown after browser execution.
- The phishing flow requests a user code and verification URI, then displays the code to persuade victims to authorize access through Microsoft’s legitimate device login flow.
- The page polls the device-code session until authorization completes, then redirects the victim to OneDrive.
- The analysis identifies gate-check, device-start, and session-status endpoints used to control and monitor the flow.
- Investigators can use DOM changes, browser requests, signatures, and selected indicators to analyze the activity and pivot to related phishing campaigns.
- The article reports recent activity concentrated in the United States and Europe, targeting organizations across several industries.
Article Details
- Attack Vectors
- EvilTokens uses a phishing page whose HTML is encrypted with AES-GCM and becomes visible after browser-side decryption.
- The phishing flow prompts victims to complete Microsoft's legitimate device login flow, obtaining account access without directly stealing the victim's password.
- The page requests a user code from the backend, displays it to the victim, and polls the device-code session status until authorization completes.
- Defensive Notes
- Inspect browser-rendered DOM changes and browser-level HTTP requests to reveal content and behavior hidden from static URL or network-level analysis.
- Review the device-code flow endpoints and session behavior, and validate the associated domain, URI, and hash before using them in detections.
- Avoid blocking or detecting shared CloudflareNet infrastructure solely on the basis of an observed IP address, as this could affect legitimate services.
- Use decrypted page code, browser requests, endpoints, and behavioral patterns to develop phishing signatures, threat-hunting hypotheses, and detection rules.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | emp01825[.]workers[.]dev | Domain identified by the article as a specific EvilTokens session indicator for validation and detection. |
| MD5 | fcd1b654a0b3e8f85ca7cfdafe494d4b | MD5 hash identified by the article as an indicator from the EvilTokens session for validation and detection. |
MITRE ATT&CK
Vendors
Products
Microsoft 365 Apps for EnterpriseAs a result, static URL analysis may miss the most important part of the attack, leaving teams with incomplete evidence, slower triage, and longer exposure to a potential Microsoft 365 compromise.Microsoft OneDriveOnce the status changes to completed, the script stops polling, displays a success screen, and redirects the victim to the legitimate OneDrive website.