New AI-Driven Phishing Campaign Subverts Microsoft’s Device Code Flow

Microsoft Defender Security Research details a large-scale phishing campaign that abuses the Device Code Authentication flow to hijack organizational accounts. Attackers used a PhaaS toolkit (EvilToken) with dynamic device-code generation, clipboard hijacking, automated polling, AI-personalized lures, and serverless hosting to evade detection; once inside, they performed Microsoft Graph reconnaissance and created mailbox rules to exfiltrate value (e.g., wire transfer details) and maintain persistence.