A coordinated effort led by Microsoft's Digital Crimes Unit has disrupted EvilTokens, a phishing-as-a-service platform responsible for compromising more than 12,000 Microsoft accounts spanning over 10,000 organizations. The operation, which launched in February, was the first PhaaS service to operate device-code authentication at scale while incorporating AI-powered capabilities to help attackers craft phishing messages and identify valuable targets within compromised environments.
Microsoft worked alongside Health-ISAC, law enforcement agencies, and SpyCloud, an Austin-based identity threat protection firm, to coordinate the infrastructure takedown. Two men, aged 32 and 38, suspected of administering the EvilTokens website were arrested in the United Kingdom after the Metropolitan Police Service received information about them in August. Warrants were executed on Friday at locations in Canary Wharf and Nine Elms, with both suspects released on bail pending further investigation.
The Met remains committed to holding people to account who facilitate criminal enabling functions and think they can remain undetected. We will find you and take action.
Detective Inspector Serena D'Adamo, Metropolitan Police Service
Device-code phishing at scale
Microsoft tracks the threat actor behind EvilTokens as Storm-2992, noting that the platform's campaigns targeted organizations across wholesale distribution, construction, financial services, real estate, higher education, and healthcare. The service specialized in device-code phishing, a technique that exploits Microsoft's OAuth 2.0 device-authorization flow to obtain authentication tokens even when multi-factor authentication is enabled, bypassing the need for credential theft.
The surge in device-code phishing attacks this year reflects broader adoption of the method among threat actors. By April, at least 10 phishing platforms had incorporated support for this capability. SpyCloud's analysis of recaptured data revealed more than 8,708 compromised accounts across 6,585 corporate email domains in 79 countries.
Device-code phishing exploits a legitimate authentication mechanism designed for devices with limited input capabilities, such as smart TVs, printers, conferencing systems, and certain Teams devices. An attack begins when the attacker initiates a device-code request and embeds the resulting code into a phishing message. Victims are directed to a page displaying the code alongside a button linking to Microsoft's genuine login portal, where they authenticate unknowingly.
Service offerings and operational model
Storm-2992 promoted EvilTokens through Telegram, offering access for $500 per month or a one-time payment of $1,500. Additional tools—including anti-bot redirectors, B2B and SMTP sending capabilities, and an Office 365 capture-link utility—were sold separately. The platform provided 44 customizable phishing kits impersonating document-signing services, Microsoft products, cloud storage providers, invoicing systems, voicemail, and eFax platforms.
Phishing emails used varied subject lines referencing construction bids, partnership agreements, compensation notices, proposals, shared files, invoices, and password expiration warnings. Once an account was compromised, EvilTokens leveraged Microsoft Graph to map organizational structures and deployed AI tools to scan mailbox content for high-value targets. The platform could identify wire-transfer details, pending invoices, and executive communications, then generate contextually tailored business email compromise messages.
Evasion techniques and geographic targeting
To evade detection systems, EvilTokens employed multi-stage redirects, PDF attachments, HTML files, and fake CAPTCHA pages to obstruct automated analysis. Traffic was routed through compromised websites and legitimate cloud services including Vercel, Cloudflare Workers, and AWS Lambda. Analysis showed that approximately 97.5 percent of compromised accounts belonged to enterprise domains, with the United States as the primary target, followed by Canada, Australia, the United Kingdom, and Saudi Arabia.
Disruption and ongoing threats
The takedown involved obtaining legal authority to seize active infrastructure associated with the phishing service. However, Microsoft clarified that this was not a complete shutdown operation, and the threat remains active, though attack volumes are expected to decline noticeably. Affiliates have already created successor platforms such as APToken, indicating that device-code phishing services continue to proliferate.
Defense recommendations
- Disable device-code authentication when not operationally required and block the device-code flow wherever feasible
- Verify the application being authenticated to and refrain from proceeding if the login destination is unexpected
- Monitor for suspicious login activity and implement phishing-resistant authentication methods such as FIDO2 security keys or passkeys