Microsoft Disrupts EvilTokens Device Code Phishing Service

On September 22, 2026, Microsoft announced a coordinated disruption effort targeting EvilTokens, a phishing-as-a-service (PhaaS) platform designed to exploit the Microsoft 365 device code authentication flow. The service enabled threat actors to bypass traditional multi-factor authentication by tricking users into approving sign-in requests on their own devices.

As part of the operation, Microsoft seized 50 websites and disabled more than 150 domains used by the platform. The company stated that the infrastructure was being used to conduct credential phishing and session hijacking against Microsoft 365 enterprise accounts. Microsoft said it worked with law enforcement agencies to take down the infrastructure, though specific agencies were not named in the announcement.

The device code flow is a legitimate authentication mechanism intended for scenarios such as signing in on devices without a browser, but EvilTokens abused this flow by presenting fake device codes to users. When users entered the code on their machines, attackers gained access to their accounts. Microsoft has not disclosed the total number of compromised accounts but indicated that the campaign targeted organizations across multiple sectors.

The takedown is part of Microsoft's broader effort to disrupt PhaaS operations that lower the barrier to entry for credential theft. The company emphasized that no customer data was accessed during the disruption operation itself.