Microsoft Disrupts EvilTokens Device-Code Phishing Infrastructure

Microsoft announced the takedown of the EvilTokens device-code phishing service, a campaign that leveraged artificial intelligence at every stage of the attack chain to compromise email inboxes. The operation was carried out with authorization from the U.S. District Court for the Eastern District of Virginia and involved collaboration between Microsoft, Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, and Shadowserver.

The EvilTokens service was designed to intercept device-code flows, a legitimate authentication mechanism, to bypass multi-factor authentication and gain unauthorized access to victim email accounts. By using AI-driven techniques, the operation adapted quickly to evade detection and target a broad range of organizations.

The takedown involved legal action and technical disruption of the phishing infrastructure. Microsoft emphasized that no software patch is required, as the mitigation stems from the disruption of the malicious service itself. Organizations are advised to enforce device-code phishing-resistant MFA solutions and conduct user training to recognize device-code phishing attempts.

The collaboration included Cloudflare providing network-level protection, Coinbase and OpenAI contributing intelligence, Railway assisting with infrastructure analysis, SpyCloud supplying credential data, and Shadowserver supporting technical takedown efforts. Health-ISAC coordinated the response within the healthcare sector.