Unmasking EvilTokens: Getting to the root of device code phishing

Microsoft Threat Intelligence describes EvilTokens, an AI-powered phishing-as-a-service used by the actor Storm-2992 to automate device-code (OAuth) phishing at scale, enabling token theft, mailbox exfiltration, persistent access (malicious inbox rules and device registration), and targeted business email compromise across thousands of organizations; the report includes operational details, observed infrastructure and evasion techniques, examples of the attacker control panel, detection/hunting queries, and mitigation recommendations.