Extended Rapid Response: Zimperium's On-Device Coverage of the EvilTokens Multi-Brand Phishing Campaign

Research from Sekoia.io and Zimperium details "EvilTokens," a widespread Phishing-as-a-Service campaign that uses device-code OAuth phishing against Microsoft 365 to obtain persistent refresh tokens and bypass both credentials and MFA; the kit leverages trusted brand lures, disposable Cloudflare Workers infrastructure, and in-browser AES-GCM encryption to evade analysis, and Zimperium's Mobile Threat Defense can detect and block the mobile phishing URLs while researchers have published hundreds of IOCs on GitHub.