Unmasking EvilTokens: The Stealthy Evolution of Device Code Phishing
The lines between sophisticated nation-state espionage and opportunistic cybercrime have never been blurrier. Today, we’re pulling back the curtain on "EvilTokens," a targeted phishing campaign that signifies a major evolution in attacker tradecraft—one specifically engineered to bypass the very security controls we rely on for identity protection. This deep dive exposes how threat actors are abusing standard authentication protocols to hijack enterprise sessions, paving the way for AI-assisted executive impersonation and devastating invoice fraud.
For years, the security community has focused on "token theft" as a post-compromise objective. However, the EvilTokens campaign flips the script by weaponizing the identity handshake itself. By abusing the OAuth 2.0 device authorization grant—a feature designed for devices without browsers, like smart TVs and command-line interfaces—attackers are able to phish users without the need for malicious links that trigger classic defenses. This is a stark reminder that in modern cybersecurity, the protocols designed for user convenience are often exploited as backdoors into the enterprise network.
The Anatomy of a Modern Phishing Attack
Traditional phishing relies on convincing a victim to enter credentials into a fake website. EvilTokens, however, targets the "device code flow" of authentication. In this attack, the hacker initiates a legitimate authentication request on their own device but uses a social engineering lure to convince the victim to complete the login on their device. The victim visits a legitimate URL (like microsoft.com/devicelogin), enters the provided code, and then enters their credentials and multi-factor authentication (MFA) token.
Once the victim does this, the attacker receives a valid access token and refresh token without ever handling the user's password. This effectively neutralizes the security benefit of MFA—the victim is technically "authorized" by both password and second factor, but the session is being captured by the threat actor. Because the initial URL is a legitimately registered Microsoft or Google domain, URL filters and security awareness training often fail to raise a red flag, making this a highly effective vector for a data breach.
From Phishing Kit to Root Access: The EvilTokens Arsenal
The core of the EvilTokens operation is a sophisticated phishing kit deployed on malicious infrastructure. The researchers who unmasked this campaign noticed that the attackers were leveraging open redirects on legitimate services to obscure their final destination. More importantly, the kit included a "reverse tunnel" feature. This means that if a victim is accessing the internet through a restrictive firewall, the attacker can use the victim's browser as a proxy to communicate with internal resources.
This is where the attack transitions from "simple" credential compromise to a full-blown network intrusion. By hijacking the token, the attacker can access Outlook, SharePoint, and OneDrive. They harvest emails to identify financial controllers and executives. But the malicious innovation doesn’t stop there. The attackers specifically target inbox rules to create mail forwarding to attacker-controlled addresses, setting up persistent access that survives password changes and even the reset of the initial refresh token.
AI-Assisted Executive Impersonation
This is the angle that should keep CISOs awake at night. Once the malware-like persistence is established, the attacker pivots to the final objective: financial fraud. Using harvested data, the attacker crafts highly convincing "executive impersonation" emails. However, the attackers are now feeding the stolen data into generative AI models to perfect their grammar and mimic the tone of the C-suite victims. This isn't a generic "send me gift cards" scheme; it's a data-driven operation where the malicious actor requests wire transfers with the exact phrasing and timing that matches the executive's calendar and writing style.
The Invoice Fraud Connection
The EvilTokens operators have a distinct preference for B2B tech companies, often hitting their supply chain to attack larger targets. The ultimate payload is invoice fraud. After monitoring inboxes to understand billing cycles, the attacker sends modified invoices to accounts payable teams. These invoices feature the same logos, bank addresses, and purchase order numbers as legitimate ones, but with the bank account details swapped for the attacker's account.
This method of malware-free, low-and-slow phishing has proven exceptionally successful. Because the attacker is operating within the legitimate context of the email server and using valid tokens, the messages pass DKIM and SPF checks. The only vulnerability is the human eye, and with the sheer volume of transaction emails, even a brief lapse in attention can result in a loss of hundreds of thousands of dollars.
Rooting Out the Credential Phishing Vulnerability
To mitigate the risk posed by EvilTokens, security researchers recommend a multi-layered strategy that extends beyond standard endpoint detection. First, organizations must disable the device code flow in their tenant policies unless strictly necessary. If it is required, Conditional Access policies should be enforced to deny device code authentication for risky sign-in sessions.
Secondly, IT departments should monitor for anomalous combinations of applications and IPs. If a user authenticates from a corporate IP range but the token is then used from a residential IP in a different region within seconds, it’s time to terminate the session. Security information and event management (SIEM) alerts should be configured to flag any logins where the application is a "Device Authentication" service that is not on the approved list.
Finally, the human element remains the ultimate vulnerability. Users must be educated that they should never enter credentials unless they initiated the request. Receiving a prompt to enter a code that they did not request is the prime indicator of this attack. Combining strict conditional access with aggressive session expiration ensures that even if a token is stolen, the window of opportunity for fraud is severely compressed.
Conclusion
EvilTokens highlights a pivotal shift in the hacking ecosystem: the move from exploiting technical system flaws to abusing identity trust. It is a potent cocktail of phishing, token theft, and AI-created deception that underscores the fragility of modern authentication. As security researchers continue to unravel device code phishing, we are reminded that while our technology may evolve, the attackers are evolving with it. Staying secure means assuming that identity will be attacked and preparing the defense of the authentication layer as robustly as we defend the network perimeter.