EvilTokens AI-Augmented Device Code Phishing for BEC

First identified in early March 2026, EvilTokens is a novel Phishing-as-a-Service (PhaaS) platform specializing in Microsoft device code phishing. Unlike traditional credential-harvesting kits, EvilTokens tricks victims into entering a legitimate alphanumeric code into Microsoft's own device login page. This grants the attacker a long-lived refresh token and access to the victim's account without directly interacting with the user's password or MFA process. The kit has been rapidly adopted by cybercriminals for high-impact Business Email Compromise (BEC) campaigns.

Technically, EvilTokens provides an advanced administration panel that includes token weaponization tools, a built-in webmail interface for mailbox access, and a unique AI-driven analysis pipeline. By leveraging Large Language Models (LLMs) like Llama-3.1 via the Groq API, the backend automatically performs reconnaissance through the Microsoft Graph API, scans up to 5,000 emails for financial exposure, identifies payment-related threads, and drafts context-aware BEC lures. This automation significantly lowers the technical barrier for attackers and reduces the response time for defenders to a matter of minutes.

The global reach of EvilTokens is extensive, with infrastructure spanning over 1,000 domains. Affected sectors include finance, HR, transportation, and logistics across the Americas, Europe, and Asia. The shift toward AI-augmented post-compromise activities represents a major evolution in the BEC landscape, enabling attackers to execute highly realistic, victim-tailored social engineering at a massive scale.