The shift: from credential theft to token theft
A coordinated wave of phishing campaigns operating under the “EvilToken” umbrella is targeting Microsoft 365 authentication flows, and they’re succeeding without ever stealing a password.
Rather than building fake login pages to harvest credentials, EvilToken operators socially engineer victims into completing legitimate Microsoft authentication, then hijack the authenticated session itself. MFA completes successfully. The user signs in normally. The attacker walks away with an active session token that grants the same access as the legitimate user.
This is the most consequential shift in identity attacks in years:
Credential theft → session and token theft.
Traditional password-focused defenses, including most MFA implementations, are no longer sufficient on their own.
Inside the EvilTokens ecosystem
EvilTokens isn’t a single phishing kit. It’s a structured Phishing-as-a-Service (PhaaS) operation marketed through Telegram, complete with subscription tiers, customer support channels, dashboards, and onboarding flows. The operation looks and behaves like a legitimate SaaS company, built entirely for offensive operations against Microsoft 365 tenants.
Based on publicly observable Telegram promotional material, EvilTokens markets a modular toolkit that includes:
- Microsoft 365 account access tooling
- Token and session capture systems
- Bulk email automation infrastructure
- Email validation and reconnaissance platforms
- Browser-based session replay utilities
- Anti-bot and redirect infrastructure
Pricing tiers run from $299/month to $499/month, paid in cryptocurrency. Customer support is available through dedicated Telegram handles. The operational model is engineered for scale — and to lower the technical bar for participation. Telegram has become the center of gravity for this kind of criminal commerce, offering attackers a low-friction distribution channel that’s far easier to operate than traditional dark-web marketplaces.
Why Microsoft 365 is the target
A single Microsoft 365 compromise unlocks the rest of an enterprise: corporate email, SharePoint documents, Teams conversations, OneDrive storage, and administrative controls. From that foothold, attackers can move laterally, exfiltrate sensitive data, or stage downstream attacks against partners and customers.
Session tokens are temporary by design. But for an attacker, “temporary” is plenty of time to do significant damage.
The advertised toolkit
The EvilTokens product surface mirrors a real SaaS catalog:
- A bulk sender that pushes email through compromised Microsoft 365 accounts using Graph API and bearer tokens, with template-based campaigns, recipient list management, and real-time delivery tracking.
- SMTP infrastructure with DKIM and domain management, parallel sending workers, open/click tracking, and IP rotation.
- An Office 365 capture mechanism that abuses Microsoft’s device login flow to capture tokens after legitimate authentication, with a backend panel for session retrieval.
- A post-exploitation browser that loads stolen tokens into a browser environment, granting attackers immediate access to Outlook Web Access, SharePoint, OneDrive, and administrative portals, without ever prompting for credentials.
Reconnaissance: validating targets before campaigns launch
A standout component of the EvilTokens ecosystem is a Microsoft 365 email validation service hosted on attacker-controlled infrastructure. Before campaigns are launched, operators use it to:
- Confirm whether email addresses exist in Microsoft 365 tenants
- Process bulk lists via CSV/TXT upload
- Identify active enterprise accounts
- Filter for high-value targets
This converts phishing from a spray-and-pray model into a data-driven targeting pipeline. Campaigns reach inboxes that are confirmed active, in tenants that are confirmed valuable — significantly improving conversion rates and reducing detection noise.
Attack technique: abusing the Microsoft Device Code Flow
The defining attack vector in EvilToken campaigns is abuse of Microsoft’s legitimate OAuth device authorization workflow — the same authentication flow Microsoft designed for devices with limited input capabilities like smart TVs, IoT devices, and CLI tools.
Attackers exploit the trust users place in microsoft.com domains to walk victims through a legitimate authentication process under attacker-controlled parameters. Because the actual login happens on real Microsoft infrastructure, traditional URL-inspection training doesn’t catch it, and email defenses see only a benign-looking redirect.
Attack sequence
1. Initial lure. Victims receive phishing emails themed as shared documents, voicemail notifications, calendar invites, quarantine alerts, or Adobe/DocuSign signature requests — established brand impersonation themes that consistently produce engagement.
2. Redirect to a legitimate Microsoft authentication page. Because the destination is a real Microsoft domain, users are far less likely to suspect malicious activity. Security-awareness training that emphasizes “check the URL” doesn’t catch this.
3. Device code entry. Victims enter a code provided by the attacker. Microsoft processes the authentication normally — including MFA.
4. Token issuance. OAuth tokens are issued by Microsoft. Session artifacts become bound to the attacker-controlled device session.
5. Session replay and access. Attackers replay the tokens to access Outlook Web Access, SharePoint, OneDrive, and administrative services as the legitimate user.
This is not traditional password theft. It is session replay and trust exploitation, executed through legitimate authentication mechanisms.
The infrastructure layer: where the lures live
EvilToken operators rely heavily on disposable cloud infrastructure, particularly Cloudflare Workers subdomains: for rapid deployment, domain rotation, and resilience against takedowns. The same lure themes appear and reappear across campaigns: Adobe Acrobat signing requests, Microsoft OneDrive and SharePoint document shares, Outlook calendar invites, email quarantine alerts, voicemail notifications, and fax messages.
The shared pattern is that the lure infrastructure impersonates a trusted brand to drive the victim toward Microsoft’s real authentication flow. Detecting and removing that lure infrastructure — before victims engage with it — is one of the highest-leverage points in the entire attack chain. According to recent research, the average phishing site has a lifespan of under 12 hours before takedown, while the median time for a user to click a phishing link is 21 seconds. If detection runs in days, defenders are operating in the wrong unit of time.
Why this attack model is dangerous
EvilToken-style phishing works precisely because it sidesteps the assumptions most security programs are built on:
- It bypasses MFA through session reuse rather than credential capture
- It exploits legitimate authentication flows that endpoint and email defenses are trained to trust
- It captures no passwords, leaving fewer artifacts for traditional detection
- It works in hardened environments where password security is otherwise strong
“MFA protects us” is no longer a complete answer. Token-aware monitoring and phishing-resistant authentication are.
Defensive recommendations
Defending against session and token theft requires shifting from password-centric controls to identity-centric ones, and adding external visibility to catch attacks before they reach employees.
Identify and access controls
- Enforce phishing-resistant MFA. FIDO2 security keys, passkeys/WebAuthn, and certificate-based authentication are significantly more resistant to token phishing than push notifications or OTP factors.
- Restrict device-code authentication. Disable unused device-code flows, restrict OAuth device enrollment, and limit legacy authentication wherever operationally feasible.
- Apply conditional access policies based on device trust, user risk, geolocation, impossible travel, and session risk scoring.
Monitoring and detection
Security teams should actively monitor for:
- OAuth consent activity and unusual app registrations
- Device-code authentication attempts
- Anomalous session creation patterns
- New mailbox forwarding rules
- Token and session anomalies
- Impossible travel events across authenticated sessions
External attack surface visibility
Internal controls catch attacks that have already reached the user. External monitoring catches them earlier — at the lure infrastructure layer, before the phishing email ever lands. That means continuous detection across:
- Lookalike domains and phishing pages impersonating your brand or your vendors
- Disposable hosting and Workers-style platforms used for lure deployment
- Telegram channels and dark web forums where PhaaS toolkits, stolen credentials, and target lists are traded
- Brand assets being used in scam ads, fake apps, and social impersonation accounts
Incident response
If compromise is suspected:
- Revoke all active sessions immediately
- Reset credentials
- Review and remove mailbox forwarding rules
- Audit Azure AD / Entra ID sign-in logs
- Investigate OAuth grants and device registrations
- Review persistence mechanisms across the tenant
The bigger picture
EvilToken represents a structural shift in how phishing operates. The threat is no longer a single attacker building a single phishing page — it’s a productized, subscription-based criminal ecosystem with onboarding, dashboards, and support. The barrier to running coordinated identity attacks at scale has collapsed.
Defenders need to operate at the same level of sophistication. That means detection that spans the full attack surface: the impersonated brands and lure pages staged on disposable cloud infrastructure, the validator services performing reconnaissance against your tenant, and the OAuth and device-flow abuse happening inside Microsoft 365 itself.
Bolster AI monitors the external attack surface for exactly this kind of activity; brand impersonation lures, phishing infrastructure deployed across hosting providers and Workers-style platforms, and the early indicators in Telegram channels and underground forums that point to coordinated campaigns before they reach employees and customers. Our AI-driven detection, supported by human analysts for edge cases and complex threats, surfaces and removes the lure infrastructure that operations like EvilToken depend on.
The EvilToken ecosystem is a clear signal that external threat protection and internal identity defenses both have to evolve together.
