Executive Summary
A significant rise in Business Email Compromise (BEC) attacks leveraging Microsoft's device code login flow has been observed, with some frameworks like EvilTokens using advanced techniques to evade detection. Unlike traditional Attacker-in-the-Middle (AitM) attacks, device code phishing utilizes legitimate Microsoft authentication endpoints, making it difficult for users to distinguish from valid sign-in requests.
Technically, these attacks trick victims into entering a short alphanumeric code on official Microsoft pages. This grants the attacker a refresh token, which can often be upgraded to a Primary Refresh Token (PRT) or used across the Microsoft 365 ecosystem. Advanced kits like EvilTokens utilize AES-GCM encrypted payloads to bypass static signature-based detection in browsers.
This trend represents a critical risk to organizations as it effectively bypasses traditional MFA. Defenders must implement a layered approach, including Conditional Access policies to block device code flows for non-essential users and utilizing linkable token identifiers for forensic investigation of shared session IDs.