O365 Device Code Phishing Campaign using EvilTokens and Abusing Railway Platform (Campaign)

A reported phishing campaign leverages the EvilTokens Phishing-as-a-Service platform and the OAuth/OIDC Device Code Flow to bypass MFA for Office 365 accounts: victims are prompted to enter a code on the legitimate microsoft.com/devicelogin page, which authorizes an attacker-controlled device and yields access/refresh tokens; attackers host infrastructure on Railway, and the technique uses legitimate Microsoft pages to evade detection.