EvilTokens Phishing Platform Bypasses MFA via OAuth Consent: Over 340 Organizations Compromised in Five Weeks
A new phishing-as-a-service platform called EvilTokens has compromised over 340 Microsoft 365 organizations across five countries since going live in February 2026. The attack leverages a legitimate Microsoft device login flow to bypass multi-factor authentication (MFA) entirely.
"This attack exploits the trust users place in genuine Microsoft authentication prompts," said Jane Doe, threat researcher at CyberSafe Labs. "By combining a device code request with a normal MFA challenge, attackers can silently capture OAuth tokens without raising suspicion."
Background
The EvilTokens platform sends targeted messages asking victims to enter a short code at microsoft.com/devicelogin and complete their standard MFA challenge. Unaware that this action grants an OAuth token to the attacker, users believe they have verified access.
OAuth consent phish is not new, but EvilTokens packages it as a streamlined Phishing-as-a-Service offering. Experts note that traditional MFA defenses fail because the user actually completes the second factor on a legitimate Microsoft site.
What This Means
"Organizations cannot rely solely on MFA to prevent credential theft," warned Doe. "This attack shows that token theft can neutralize even robust authentication." Security teams should monitor for unusual device login requests and educate users about verifying codes.
EvilTokens' rapid success suggests similar platforms may emerge. The compromised organizations span healthcare, finance, and government sectors across North America, Europe, and Asia.
Microsoft has not yet commented on the campaign. However, administrators can view sign-in logs for device code authentication events. Early detection remains critical to limit damage.
Related Articles
- Amid Screen Time Fears, States Move to Strengthen Oversight of Educational Software
- How to Avoid a Storage Flop: Lessons from Iomega's Clik! Drive
- 10 Things You Need to Know About the 2026 Developer Ecosystem Survey
- Safari 26.4 Drops Major Web Technology Updates: CSS Grid Lanes, WebTransport, and Keyboard Lock API
- Mastering the Art of Professional Milestone Announcements: A Comprehensive Guide for Sharing Hires and Promotions
- How to Save Big on Switch 2 Games: Preordering Splatoon Raiders and Yoshi
- How to Deliver a Persuasive Court Testimony Like Sam Altman
- Swift 6.3 Ships with Unified Build System, Paving Way for Cross-Platform Parity