Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse

Cybersecurity vendors report an active device-code phishing campaign that leverages Cloudflare Workers and Railway-hosted infrastructure to harvest Microsoft 365 OAuth tokens from victims across more than 340 organizations in multiple countries; attackers use multi-hop redirects, landing-page code generation, anti-analysis controls, and a phishing-as-a-service (EvilTokens) to bypass filters and persist access (tokens remain valid despite password resets).