Microsoft Disrupts EvilTokens Device Code Phishing Service

Microsoft has successfully disrupted the operations of 'EvilTokens,' a sophisticated phishing-as-a-service platform specifically designed to compromise Microsoft 365 accounts. In a coordinated enforcement action, the company seized 50 websites and disabled over 150 domains associated with the service. EvilTokens utilized a device code phishing technique, which tricks users into authorizing malicious applications by entering a code on a fraudulent login page. This method bypasses traditional password-based security by capturing authentication tokens directly. By dismantling the infrastructure behind this campaign, Microsoft aims to mitigate the threat posed to enterprise users who rely on its cloud services. The company continues to urge organizations to implement robust multi-factor authentication and monitor for suspicious application consent requests to prevent similar attacks. This disruption marks a significant blow to cybercriminals leveraging automated tools to scale their phishing operations against corporate environments.