Microsoft Threat Intelligence describes EvilTokens as a phishing-as-a-service platform that abuses device code authentication and can take over Microsoft 365 accounts without classic password disclosure. The Microsoft Security Blog cites more than 12,000 compromised inboxes across over 10,000 organizations worldwide and gives concrete protection guidance for Microsoft Entra ID, Conditional Access, Defender XDR, and Exchange Online. For small and midsized organizations, the important question is practical: are device code flows, risky sign-ins, mailbox rules, and token response controls configured so that a confirmed incident becomes visible and containable quickly?
What Microsoft reported on 22 September 2026
Microsoft reports that EvilTokens has been used since February 2026 for AI-assisted lures, automated infrastructure, and token theft. The attacker starts a legitimate device code flow, shows the user a code, and sends the user to the real Microsoft page at microsoft.com/devicelogin. If the user confirms that code, they are not authorizing their own device; they are approving the attacker’s session.
Microsoft then describes typical follow-on activity: email access, Microsoft Graph reconnaissance, newly registered devices, more durable access paths, and malicious mailbox rules. Microsoft’s Digital Crimes Unit facilitated disruption of infrastructure used by the service, but the recommended controls remain relevant because device code phishing is a technique, not a risk tied to only one provider.
Why this affects smaller organizations
The lures fit normal business workflows: invoices, requests for proposals, shared files, voicemail, or supposed Microsoft cloud notices. Organizations with 10 to 250 seats often have fewer separated roles but many shared mailboxes, project folders, and external contacts. One compromised account can therefore affect invoices, customer communication, and internal approvals.
- Device code sign-in can look like a normal Microsoft step to users.
- MFA does not help when the user personally approves the attacker’s flow.
- Mailbox rules can hide warnings and replies from the affected user.
- Graph requests show whether the attacker searched additional data areas.
Urgency: active technique, not a fixed deadline
Microsoft does not publish a future deadline for this issue. The concrete action is a timely configuration and signal review. The most important areas are Conditional Access controls for authentication flows, Entra ID risk signals, Defender for Office 365 protection against phishing links, Safe Links, Zero-hour auto purge, and response steps for compromised mailboxes.
For environments using Conditional Access, Microsoft recommends blocking device code flow wherever possible and tightly scoping required exceptions. If Teams devices or conferencing devices really need the flow, the exception should be limited to defined resource accounts. This is not licensing advice; it is a technical access-control review.
Which signals belong together
A single link or IP address is rarely enough for assessment. Microsoft lists Defender XDR detections for anomalous device code authentication, anomalous token exchange after device code authentication, device registration, unusual Microsoft Graph activity, and suspicious mailbox rules. The finding becomes stronger when these events are reviewed as a sequence.
In Microsoft Defender and Entra ID, administrators should therefore connect user, time, application, device, mailbox rule, and follow-on access. If an account suddenly performs Graph queries, creates rules, or touches many messages after a device code sign-in, the response is more urgent than for an isolated alert.
Concrete next steps for administrators
- Review device code flow in Conditional Access and block unnecessary use.
- Document and tightly scope exceptions for Teams or conferencing devices.
- Correlate risky sign-ins, Safe Links events, and Defender XDR alerts.
- Search for suspicious mailbox rules, forwarding, and inbox manipulation.
- For confirmed compromise, revoke sessions and invalidate refresh tokens.
- Check Network Protection, Web Protection, and anti-phishing policies.
For a Microsoft Security Assessment, this becomes a compact test case: does the environment expose device code phishing during sign-in, token use, and mailbox-rule creation, or only after data access?
Official Microsoft sources
- Microsoft Security Blog: Unmasking EvilTokens
- Microsoft Learn: Block authentication flows
- Microsoft Learn: Responding to a compromised email account
- Microsoft Learn: Inbox manipulation rules playbook
If you want to know whether Entra ID, Defender XDR, and Exchange Online make this attack chain visible in your environment, we can review your Microsoft 365 security configuration in a focused assessment – get in touch.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
