EvilTokens Emerges as New Phishing-as-a-Service Platform for Microsoft Account Takeover

**EvilTokens is a Phishing-as-a-Service discovered in early 2026 that abuses Microsoft’s OAuth 2.0 device code flow to trick victims into authorizing attackers, allowing theft of access and long-lived refresh tokens (and in some cases conversion to PRT) for persistent Microsoft 365 account access; the platform—distributed via Telegram, offering templates, automation, and reconnaissance—has been widely adopted by criminals across multiple continents (over 1,000 domains tracked) and is used in BEC and AitM-style campaigns, with recommended mitigations including disabling unnecessary device code authentication, monitoring device_code grant sign-ins, YARA detection, and user training.**