Executive Summary
A significant surge in Business Email Compromise (BEC) campaigns utilizing device code phishing has been observed, with some frameworks like 'EvilTokens' scaling rapidly. These attacks exploit Microsoft's device code login flow—originally intended for browserless devices—to trick users into authorizing attacker-controlled sessions on official Microsoft domains, effectively bypassing traditional Multi-Factor Authentication (MFA).
Technically, these campaigns use single-page applications and encrypted loaders to deliver phishing UIs that fetch real-time device codes from Microsoft endpoints. By impersonating applications like Microsoft Office or the Microsoft Authentication Broker, attackers can register unauthorized devices and acquire Primary Refresh Tokens (PRTs) that survive session revocations and provide persistent access to the victim's entire M365 ecosystem.
This trend is particularly dangerous because the final authentication occurs on legitimate Microsoft infrastructure, making it difficult for users to distinguish from valid requests. Organizations must implement strict Conditional Access Policies and monitor Entra ID logs for suspicious authentication protocols and unusual device registration patterns to mitigate this risk.