EvilTokens device-code phishing kit totally more evil than we all thought

The report details the EvilTokens device-code phishing kit and an associated ARToken phishing-as-a-service operation that bypasses Microsoft 365 MFA to silently authenticate as victims; attackers use targeted invoice lures, legitimate-looking SharePoint hosts, and sophisticated evasion. Cisco Talos found evidence of large-scale campaigns (multiple daily waves), infrastructure and API sharing with EvilTokens, and a mature post-exploitation/BEC toolkit that offers Outlook read/send access, inbox rules, token management, and persistence mechanisms.