EvilTokens ramps up device code phishing targeting Microsoft 365 users

Security researchers report a notable increase in device-code phishing against Microsoft 365 driven by EvilTokens, a Telegram-distributed phishing-as-a-service that automates lure creation, Microsoft API interactions, and harvesting of access/refresh tokens (and potentially PRTs) to bypass MFA and maintain persistent account access; the kit includes ready-made templates targeting finance, HR and logistics and provides post-compromise triage features, and defenders are advised to train users, restrict device code authentication via Conditional Access, monitor anomalous sign-ins, and revoke suspected refresh tokens.