Executive Summary
EvilTokens is a Phishing-as-a-Service (PhaaS) platform that emerged in early 2026, successfully compromising over 340 Microsoft 365 organizations across five countries within its first five weeks. The service commoditizes advanced nation-state tradecraft by targeting OAuth tokens rather than user passwords, effectively rendering traditional multi-factor authentication (MFA) ineffective as victims complete legitimate authentication challenges on official Microsoft domains.
Technically, the attack leverages the OAuth device-code flow, directing users to the legitimate `microsoft.com/devicelogin` URL. Once the victim enters an attacker-supplied code and completes their MFA, an OAuth refresh token is generated and delivered to the adversary. This grant provides unauthorized access to sensitive data, including mailboxes, OneDrive, and contacts, without the attacker ever needing the user's credentials.
This threat is particularly critical because stolen OAuth tokens persist through password resets. Many affected organizations remained compromised for weeks or months after the initial event because they failed to revoke the specific OAuth tokens. The rapid adoption of EvilTokens by multiple criminal actors highlights a significant shift toward automated, high-tempo MFA-bypass capabilities that require targeted conditional access mitigations to defend against.