Hundreds of orgs compromised daily in Microsoft device code phishing attacks

Microsoft researchers observed a high-volume device-code phishing campaign (linked to the EvilTokens kit) launching multiple distinct waves daily that use AI-personalized phishing, dynamic OAuth device codes generated at the final redirect stage, and automated redirect chains through legitimate serverless platforms to evade detection, bypass MFA, and steal Microsoft 365 access tokens; post-compromise activity repeatedly targets finance-related inboxes for automated email exfiltration and persistence.