Tag: eviltokens

2 Attack Reports | 0 Vulnerabilities

Attack reports

Device Code Phishing is an Evolution in Identity Takeover

Device code phishing attacks have exploded across the threat landscape, with new toolkits emerging weekly. This surge coincides with publicly released criminal toolkits and multiple phishing-as-a-service offerings like EvilTokens and Tycoon. Threat actors abuse the OAuth 2.0 device authorization gr…
credential theft
clickfix
microsoft 365
phishing-as-a-service
account takeover
tycoon 2fa
identity compromise
device code phishing
eviltokens
kali365
oauth abuse
2026-05-14
artokens
odx
Published: May 14, 2026
Downloadable IOCs: 0

New widespread EvilTokens kit: device code phishing as-a-service

EvilTokens is a new Phishing-as-a-Service offering a turnkey Microsoft device code phishing kit. It enables attackers to harvest access and refresh tokens, granting unauthorized access to victims' Microsoft accounts. The kit supports post-compromise operations, allowing data exfiltration from vario…
microsoft 365
business email compromise
phishing-as-a-service
account takeover
2026-03-31
device code phishing
eviltokens
oauth 2.0
token harvesting
Published: March 31, 2026
Downloadable IOCs: 0
Click here to see more Attack Reports