Microsoft’s Digital Crimes Unit, in its 40th court-authorized infrastructure disruption, took down EvilTokens, a phishing-as-a-service platform that abused OAuth’s device-code authentication flow to compromise more than 12,000 email inboxes across over 10,000 organizations worldwide. A U.S. federal court in the Eastern District of Virginia authorized seizure of 50 websites and disabling of more than 150 supporting domains on September 22, working with partners including Cloudflare, Coinbase, OpenAI, and the Shadowserver Foundation.
The technique abuses a flow built for devices with limited input, like a smart TV. An attacker generates a legitimate device code and, through a phishing lure, tricks a victim into entering it on Microsoft’s real sign-in page, completing normal authentication and handing the attacker a valid session without ever touching a password, one that survives a subsequent password reset unless the underlying token is separately revoked. EvilTokens layered an AI assistant on top that analyzed a hijacked inbox, mapped organizational relationships, and recommended which threads to hijack for payment fraud. UK Metropolitan Police arrested two men, aged 32 and 38, on suspicion of operating the service on September 11.
A civil takedown seizes infrastructure, not the protocol gap underneath it, and device-code phishing has already outlived at least one prior disruption cycle since Huntress first documented the technique in March. The durable fix sits with enterprises, not with enforcement: Conditional Access policies that restrict or block the device-code flow entirely are available in Microsoft Entra ID today and, judging by a victim count still running past 10,000 organizations, remain unused by most of them, a gap CyberTech has flagged before in how unevenly enterprises govern machine and session credentials versus passwords, and one that mirrors the identity-verification blind spots CyberTech has traced in help-desk social engineering.
Source: Microsoft
