Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallEvilTokens abuses a legitimate Microsoft sign-in method called device authorization: an attacker requests a sign-in code, persuades someone to enter it on Microsoft’s genuine device-login page, then receives the authorized session. The victim may never type a password into a fake site. Microsoft says the platform emerged in February 2026 and reports more than 12,000 inboxes compromised across over 10,000 organizations worldwide; those are Microsoft’s reported totals, not a measure of every device-code phishing campaign.
What device-code phishing exploits
The legitimate device authorization flow
OAuth 2.0’s Device Authorization Grant is designed for devices where signing in through a conventional browser is inconvenient—for example, a device with limited input or browser capability. The device displays a user code and verification address. The user opens that address on another device, authenticates, and approves the request; meanwhile, the original client polls the authorization server for the result.
As an Amazon Associate I earn from qualifying purchases.
RFC 8628 explains the design: “Since the protocol supports clients that can’t receive incoming requests, clients poll the authorization server repeatedly until the end user completes the approval process.” The useful feature is also the security hinge: the client requesting access and the device where the user approves it are separate.
How the attacker turns the flow into a phish
- The attacker initiates a device authorization request and obtains a live code and verification address.
- A lure—possibly framed as a shared file, invoice, voicemail, or another work task—asks the recipient to enter the code.
- The recipient visits the genuine Microsoft device-login page, enters the attacker’s code, and completes the requested sign-in or approval.
- Microsoft authorizes the attacker’s initiating session. The attacker polls for the result and can obtain tokens for the approved session.
This is not the usual lookalike-login-page pattern. The real Microsoft page can be part of the attack because the victim is completing authentication for the attacker’s request. Microsoft’s device-login page warns, “Do not enter codes from sources you don’t trust”. An unexpected code-entry request is suspicious even when the URL is genuine.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
This does not mean multifactor authentication is useless. In this attack, the user can complete a legitimate authentication step—including an MFA challenge—on behalf of the attacker. The problem is that the user is approving a sign-in they did not initiate for a client they may not recognize.
What Microsoft and Sekoia reported about EvilTokens
Platform and campaign observations
Microsoft Threat Intelligence says EvilTokens appeared in February 2026 and attributes its development and support to Storm-2992. Microsoft describes a phishing-as-a-service platform with prebuilt email templates and landing pages, AI assistance to tailor lures, and post-compromise AI assistance to inspect mailbox activity and identify valuable targets.
Microsoft reports that EvilTokens compromised more than 12,000 inboxes in over 10,000 organizations worldwide. The figures are Microsoft’s reported observations in 2026; they should not be treated as a census of device-code phishing or as a rate that applies to every organization.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft also reports 44 themes for customizing email templates and landing pages, a $1,500 initial kit purchase and a $500 monthly continued-access subscription, and thousands of unique, short-lived polling nodes in a campaign it tracked in April 2026. These are reported criminal-market and campaign details, not legitimate product prices or general estimates.
Why infrastructure counts are different from victim counts
Sekoia Threat Detection & Research reported tracking more than 1,000 domains hosting EvilTokens pages. Separately, as of March 23, 2026, it had more than 900 confirmed results for a query searching for the X-Antibot-Token header. Those measurements describe Sekoia’s tracking and query results; they are not counts of victims, organizations, or all infrastructure in use.
Microsoft describes lures involving invoices, requests for proposals, shared files, document signing, cloud services, voicemail, and eFax. It observed malicious URLs, PDF attachments, and HTML files, along with multi-stage redirects and serverless hosting infrastructure. Reported affected industries included wholesale distribution, construction, financial services, real estate, higher education, and healthcare. Microsoft reported its highest observed victim activity in the United States, Canada, the United Kingdom, Australia, India, and France.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Sekoia’s March 30, 2026 technical report describes delivery using PDF, HTML, XLSX, SVG, and DOCX files, and activity observed across the Americas, Europe, the Middle East, Asia, and Oceania. These are the report’s observations, not a complete census of affected sectors, regions, or delivery methods.
Recommended Free Tools
What an attacker may do after approval
Use the mailbox and the account’s relationships
Microsoft reports that stolen tokens can be used to access mailboxes, analyze messages, and create malicious inbox rules that hide communications. An attacker can use mailbox context to identify financial, executive, or administrative targets, then send convincing follow-on messages to colleagues or external contacts from the compromised account.
Explore Microsoft 365 and seek persistence
Microsoft describes Microsoft Graph reconnaissance to map organizational structure and permissions, as well as registering devices to maintain access. Sekoia’s analysis describes attempts to exchange captured refresh tokens for a Primary Refresh Token and additional resource tokens, including for Outlook, Microsoft Graph, Azure, and SharePoint. It discusses possible access to Exchange Online mail, SharePoint and OneDrive documents, and Teams conversation history. These are capabilities documented in Sekoia’s analysis of the kit, not proof that every capability was used in every incident.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Which controls administrators should prioritize
Choose whether the device-code flow is needed
| Control choice | When it fits | How to apply it |
|---|---|---|
| Block device-code flow | Use where business applications and devices do not require it. | Microsoft’s first recommendation is to block the flow wherever possible. |
| Allow a narrow exception | Use only where a business device, such as a Teams device, depends on the flow. | Scope the exception to the specific Teams device resource accounts. Account for the Device Registration Service when configuring Conditional Access. |
A broad exception gives the flow more room to be abused than a device- and account-specific one. Confirm which devices actually need the grant before allowing it.
Make approval harder to manipulate
- Train users to treat unexpected requests to enter a device code as suspicious, including requests that send them to a genuine Microsoft URL.
- Ensure sign-in prompts make the application being authorized identifiable to the user.
- Configure anti-phishing policies and Safe Links. Microsoft says Safe Links together with Entra ID Protection can raise high-confidence device-code phishing alerts.
- Use phishing-resistant authentication, such as FIDO tokens or Authenticator with passkey, as part of a layered identity strategy. This does not replace controls on the device-code flow. A FIDO2 security key may be an option where platform compatibility and organizational policy permit; the cited reporting does not establish that a particular key alone prevents this attack.
Monitor for activity before and after token issuance
Monitor for suspicious inbox-rule creation, anomalous device registration, OAuth device-code authentication, token exchange, and unusual Microsoft Graph activity. Microsoft lists related detections in Defender XDR and Defender for Identity. Correlating sign-in activity with changes to mail rules, devices, and Graph access can help distinguish a completed device-code phish from an isolated lure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
How to respond when device-code compromise is suspected
- Contain the account. Follow your compromised-account response process. Microsoft recommends temporarily disabling the account when immediate containment is needed in the circumstances it describes.
- Revoke refresh tokens and require reauthentication. Consider forcing sign-in again across affected sessions. Standard session revocation may not immediately invalidate already-issued access tokens; Microsoft cautions that they can remain active for up to an hour.
- Investigate the account’s activity. Review sign-ins and token activity alongside inbox-rule creation, mailbox access, device registration, and Graph activity. Determine which resources were accessed rather than assuming that every capability described for the kit was used.
- Check for follow-on impact. Look for concealed or forwarded mail, messages sent to colleagues or external contacts, access to organizational documents or conversations, and additional accounts targeted through the compromised mailbox.
- Remove persistence and limit further exposure. Identify and remove unauthorized inbox rules or device registrations, then assess whether other accounts or resources require containment under your incident process.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
