EvilTokens OAuth Device Code Phishing & AMOS macOS Stealer — March 2026 Campaign Detection
Multi-layered detection for two linked March 2026 threat campaigns identified by ANY.RUN and Objective-See: **Campaign 1 — EvilTokens (OAuth Device Code Phishing)** Abuses Microsoft's OAuth 2.0 Device Code authentication flow to silently hijack enterprise accounts. Attackers trick users into entering a device code on Microsoft's legitimate login page, granting the attacker a valid OAuth token — no credentials stolen, no MFA bypass needed. Over 180 phishing URLs detected in a single week. Targets: Technology, Education, Manufacturing, and Government sectors (US & India focus). **Campaign 2 — AMOS Stealer (macOS ClickFix)** Distributed via a trojanized disk image (Clearl_AI.dmg) posing as an AI tool installer. Harvests browser credentials, macOS Keychain, cryptocurrency wallets (256 extensions), Apple Notes, and sensitive files. Deploys a persistent backdoor via ~/.mainhelper (WebSocket reverse shell) and LaunchAgent persistence (com.apple.mdworker.plist / com.apple.systemupdate). Kills security tools (Little Snitch, BlockBlock, Lulu) and validates stolen passwords against the keychain. 1. EvilTokens — Detects Device Code OAuth sign-ins from suspicious infrastructure (workers[.]dev phishing domains) 2. AMOS IOC Network Sweep — Identifies connections to known C2/payload domains (laislivon.com, rvdownloads.com) 3. AMOS Behavioral — Detects ClickFix-style base64 curl-to-shell execution, /tmp/helper payloads, and LaunchAgent persistence artifacts 4. Cross-platform IOC file hash matching across endpoints
Microsoft Sentinel (KQL)
