EvilTokens Used AI-Assisted Device-Code Phishing Against 344 Organizations, Huntress Says
Summary
Huntress says the EvilTokens phishing campaign affected 344 organizations across five countries, using AI-generated lures and Microsoft device-code authentication to capture valid session tokens. It recommends tighter access controls and phishing-resistant MFA.
Key points
- Huntress reports that activity escalated into a 16-day campaign affecting 344 organizations across five countries.
- The attack used Microsoft’s legitimate device-code authentication flow: victims entered a code, authorizing an attacker-initiated session and exposing a valid session token without password theft or malware.
- EvilTokens was marketed as a phishing-as-a-service platform on Telegram, reportedly priced at $1,500 plus a $500 maintenance fee.
- The platform reportedly used AI to generate role-specific lures, create device codes dynamically, and draft follow-on wire-fraud emails using context from victims’ inboxes, calendars, and documents.
- Huntress says the emails passed through Cisco, Trend Micro, and Mimecast controls, while the legitimate authentication flow made the activity difficult to distinguish at the email and URL layers.
- Recommended defenses include restricting device-code flows with conditional access, monitoring device registrations, revoking refresh tokens when compromise is suspected, and adopting FIDO2 or passkeys.
- Huntress says it applied a conditional access policy across more than 60,000 tenants to block Railway infrastructure; the article does not specify when or whether that action ended the campaign.
Article Details
- Event Type
- AI-assisted device code phishing campaign using the EvilTokens phishing-as-a-service platform.
- Impact
- A 16-day campaign beginning March 2 affected 344 organizations across five countries. Attackers obtained valid session tokens without stealing passwords or defeating MFA, then used compromised account context to automate follow-on attacks, including wire-fraud emails. Huntress reports that its response included pushing a conditional access policy across more than 60,000 tenants to block Railway infrastructure.
MITRE ATT&CK
T1114 · Email CollectionAfter token capture, the platform could scan victims' inboxes for context to support follow-on attacks.T1114.002 · Remote Email CollectionThe platform could scan victims' email messages after token capture.T1528 · Steal Application Access TokenAttackers captured valid session tokens when victims entered device codes during the authentication flow.T1566.002 · Spearphishing LinkThe campaign used phishing emails with personalized lures and links to initiate device code authentication.
People
Beth RobinsonAuthor of the article describing the EvilTokens campaign.Jamie LevyHuntress Senior Director of Adversary Tactics; discussed automated follow-on attacks after token capture.Sherrod DeGrippoMicrosoft General Manager for Global Threat Intelligence; commented on the device code phishing campaign and broader threat landscape.
Vendors
CiscoThe emails moved through Cisco, Trend Micro, and Mimecast untouched.HuntressWithin hours, Huntress was managing hundreds of incident reports, warning our partners and customers that the same device code phishing attack pattern was hitting organizations across the board at machine speed.Microsoftdoesn't steal your credentials. It borrows your session. The attack exploits a completely legitimate Microsoft authentication flow. No malware, no stolen password, no MFA to defeat. Users clicked real links, went toMimecastThe emails moved through Cisco, Trend Micro, and Mimecast untouched.Trend MicroThe emails moved through Cisco, Trend Micro, and Mimecast untouched.
Products
BlueKitOther kits like Tycoon2FA, BlueKit, and Kali365 are operating with similar levels of infrastructure and sophistication.Cisco Secure EmailThe emails traveled through legitimate Cisco Secure Email, Trend Micro, and Mimecast security controls.EvilTokensHomeBlogHow EvilTokens Turbocharges Old School Phishing with AIKali365Other kits like Tycoon2FA, BlueKit, and Kali365 are operating with similar levels of infrastructure and sophistication.Microsoft Entra Conditional AccessTools like Microsoft Entra Conditional Access can enforce these contextual constraints and restrict device code flow to specific approved scenarios.Tycoon2FAOther kits like Tycoon2FA, BlueKit, and Kali365 are operating with similar levels of infrastructure and sophistication.