New widespread EvilTokens kit: device code phishing as-a-service

Sekoia TDR identified EvilTokens, a turnkey Phishing-as-a-Service that delivers Microsoft device code phishing pages and backend tooling to harvest access/refresh tokens, convert refresh tokens to Primary Refresh Tokens and SSO cookies, and perform reconnaissance and post-compromise actions; the kit has been rapidly adopted by affiliates, impacted organizations globally, and is trackable via specific domain patterns, API endpoints, HTTP headers, IoCs and a YARA rule.