7 minhigh
New widespread EvilTokens kit: device code phishing as-a-service – Part 1
EvilTokens is a newly discovered Phishing-as-a-Service (PhaaS) platform that automates Microsoft device code phishing to facilitate Business Email Compromise (BEC). By tricking victims into authorizing a malicious device via legitimate Microsoft login portals, attackers harvest access and refresh tokens to gain persistent, unauthenticated access to Microsoft 365 environments.
Sens:■ ImmediateConf:highAnalyzed:2026-03-30reports
Authors: Sekoia TDR
ActorsEvilTokenseviltokensadmin
Source:
Sekoia.io
IOCs · 4
- domainadobe-lar[.]denise-chxhistory-com-s-account[.]workers[.]devEvilTokens administrator-hosted Cloudflare Workers phishing domain.
- domainauthdocspro[.]comEvilTokens affiliate-hosted phishing domain.
- url/api/device/startEvilTokens backend API endpoint used to initiate the device code flow and fetch the user code.
- url/api/device/status/EvilTokens backend API endpoint polled by the phishing page to check authentication status.
Key Takeaways
- EvilTokens is a new Phishing-as-a-Service (PhaaS) kit specializing in Microsoft device code phishing to facilitate Business Email Compromise (BEC).
- The kit automates the theft of access and refresh tokens, converting them to Primary Refresh Tokens (PRTs) for persistent, MFA-bypassing access.
- Phishing lures impersonate trusted services like Adobe Acrobat, DocuSign, and Microsoft applications to trick users into entering a device code on legitimate Microsoft portals.
- The backend features advanced capabilities including reconnaissance, enumeration, and one-click browser SSO hijacking.
- Campaigns are widespread globally, utilizing various attachment types (PDF, HTML, XLSX, SVG, DOCX) to deliver the phishing links.
Affected Systems
- Microsoft 365
- Entra ID
- Exchange Online
- SharePoint Online
- OneDrive
- Microsoft Teams
Attack Chain
Attackers send phishing emails with attachments (PDF, HTML, XLSX, SVG, DOCX) containing links or QR codes to EvilTokens pages. The victim visits the page, which impersonates a trusted service (e.g., Adobe Acrobat, DocuSign) and displays a device code fetched from the Microsoft API. The victim is redirected to the legitimate Microsoft device login page and enters the code, unknowingly authorizing the attacker's device. The EvilTokens backend then polls Microsoft to retrieve access and refresh tokens, converting them to Primary Refresh Tokens (PRTs) for persistent access, reconnaissance, and subsequent data exfiltration or BEC.
Detection Availability
- YARA Rules: Yes
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: Yes
- Platforms: Sekoia.io, urlscan.io, urlquery
The article provides a YARA rule to detect EvilTokens HTML phishing pages and specific search queries for urlscan.io and urlquery to identify the infrastructure.
Detection Engineering Assessment
EDR Visibility: Low — The attack primarily occurs in the cloud (Entra ID/M365) and the browser, with no malware executed on the local endpoint. Network Visibility: Medium — Network logs might capture traffic to the phishing domains or the presence of the X-Antibot-Token header, but the actual authentication traffic goes to legitimate Microsoft endpoints. Detection Difficulty: Hard — The authentication flow uses legitimate Microsoft endpoints (microsoft.com/devicelogin), making it difficult to distinguish from legitimate device code authorizations without strict conditional access policies.
Required Log Sources
- Entra ID Sign-in Logs
- Microsoft 365 Audit Logs
- Web Proxy/Gateway Logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for unusual device code authentication events in Entra ID sign-in logs, especially from unexpected geolocations or device types. | Entra ID Sign-in Logs | Credential Access | Medium |
| Hunt for web proxy logs containing the X-Antibot-Token HTTP header. | Web Proxy/Gateway Logs | Initial Access | Low |
| Monitor for sudden creation or usage of Primary Refresh Tokens (PRTs) from unknown or unmanaged devices. | Entra ID Sign-in Logs | Persistence | Medium |
Control Gaps
- Standard MFA
- Endpoint Antivirus
Key Behavioral Indicators
- X-Antibot-Token HTTP header
- URL paths /api/device/start and /api/device/status/
- Cloudflare Workers subdomains ending in -s-account.workers.dev
False Positive Assessment
- Low
Recommendations
Immediate Mitigation
- Block known EvilTokens domains and Cloudflare Worker patterns.
- Revoke active sessions and refresh tokens for users suspected of compromise.
Infrastructure Hardening
- Disable the OAuth 2.0 Device Authorization Grant flow in Entra ID if not required by the organization.
- Implement Conditional Access policies restricting device code flow to trusted networks or managed devices.
User Protection
- Deploy phishing-resistant MFA (e.g., FIDO2 security keys).
- Use email security gateways to block attachments containing QR codes or links to known PhaaS infrastructure.
Security Awareness
- Train users on the risks of device code phishing and instruct them never to enter codes from untrusted sources into Microsoft login pages.
MITRE ATT&CK Mapping
- T1566.001 - Phishing: Spearphishing Attachment
- T1566.002 - Phishing: Spearphishing Link
- T1528 - Steal Application Access Token
- T1550.004 - Use Alternate Authentication Material: Web Session Cookie
- T1114.002 - Email Collection: Remote Email Collection
Additional IOCs
- Domains:
backdoor-hub[.]com- EvilTokens affiliate-hosted phishing domainbumpgames[.]net- EvilTokens affiliate-hosted phishing domaincarbatterygurgaon[.]com- EvilTokens affiliate-hosted phishing domaincareldutoit-el[.]co[.]za- EvilTokens affiliate-hosted phishing domaindao[.]com[.]au- EvilTokens affiliate-hosted phishing domaindocusend[.]networkssolutionmail[.]com- EvilTokens affiliate-hosted phishing domaineqfit[.]co[.]za- EvilTokens affiliate-hosted phishing domaineventcalender-schedule[.]com- EvilTokens affiliate-hosted phishing domainevobothub[.]org- EvilTokens affiliate-hosted phishing domainframebound[.]cloud- EvilTokens affiliate-hosted phishing domaininfinitechai[.]org- EvilTokens affiliate-hosted phishing domaininternalmemorecord[.]bxwancheng[.]com- EvilTokens affiliate-hosted phishing domainmacmamo[.]com- EvilTokens affiliate-hosted phishing domainmirsanotolastik[.]com- EvilTokens affiliate-hosted phishing domainmirzanyapi[.]com- EvilTokens affiliate-hosted phishing domainnewmobilepolojean[.]com- EvilTokens affiliate-hosted phishing domainnotificationsmanagersec[.]com- EvilTokens affiliate-hosted phishing domainpelangiservice[.]com- EvilTokens affiliate-hosted phishing domainprcservis[.]com- EvilTokens affiliate-hosted phishing domainpromanager[.]outboundciwidey[.]com- EvilTokens affiliate-hosted phishing domainserenitygovsupplys[.]com- EvilTokens affiliate-hosted phishing domainsignaturerequired[.]thecoolcactus[.]com- EvilTokens affiliate-hosted phishing domainsmstltle[.]net- EvilTokens affiliate-hosted phishing domainstatushelper[.]aguasomos[.]com- EvilTokens affiliate-hosted phishing domainsuctwocesonesstory[.]com- EvilTokens affiliate-hosted phishing domainthesafarigarden[.]com- EvilTokens affiliate-hosted phishing domaintopbuysella[.]com- EvilTokens affiliate-hosted phishing domaintotalhomesafe[.]com- EvilTokens affiliate-hosted phishing domainupdate[.]youcreadio[.]cfd- EvilTokens affiliate-hosted phishing domainwell[.]atlantaperlnatal[.]com- EvilTokens affiliate-hosted phishing domainxlkconsulting[.]co[.]za- EvilTokens affiliate-hosted phishing domainyankeepine[.]co- EvilTokens affiliate-hosted phishing domainyouremplregroup[.]com- EvilTokens affiliate-hosted phishing domaindocusign-vs4[.]finance-zltnservices-org-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainonedrive-au8[.]hayixa9795-pazard-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainadobe-b6d[.]tuwilika-fcsnam-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainonedrive-23n[.]sbutler-stateservice-us-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainonedrive-ac4[.]ryker-samik-dropmeon-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainonedrive-33i[.]amittal-prodwaresol-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domaindocusign-d0e[.]admin-treyripple-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainadobe-t9r[.]thomas-gibson-clyde-enq-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainonedrive-7fp[.]davarius-thackery-dropmeon-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainadobe-h7l[.]gregcausey-hyundaicrenshaw-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainsharepoint-uo2[.]angela-warrconstructioninc-onmicrosoft-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainonedrive-hea[.]jhaas-hapnehartmedia-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainpage-custommmvx6290-9kb[.]snpfs90-outlook-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainindex-8ni[.]shirdav-mail-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domaindocusign-gmx[.]medea-locallovechs-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainindex-izk[.]rifkit-protonmail-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domaindocusign-t0o[.]accountsreceivable-greens-au-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainadobe-7bf[.]signature-on-invoice-required-mail-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainpage-voicemail-3i6[.]ucbqzm9-ucl-ac-uk-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainadobe-y73[.]letsgo-birdynyc-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainonedrive-dsk[.]cassandra-warholak-ifrma-org-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domaindocusign-u0p[.]kevin-domae-ca-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domaindocusign-a5c[.]export-cellular-iberia-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domaindocusign-14g[.]jhipolito-arrow-food-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainadobe-qi2[.]pm-pdgrealty-proton-me-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainadobe-8dt[.]ishaan-zvi-dropmeon-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainadobe-of6[.]hayixa9795-pazard-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domaindocusign-ffp[.]garciarodriguezt-student-wpunj-edu-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domaindocusign-y8l[.]accountant-fitfranchisebrands-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainadobe-mxg[.]snpfs90-outlook-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainindex-ap3[.]tyler2miler-proton-me-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainadobe-yzz[.]ejkim-gsglobalusa-us-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domaindocusign-520[.]mike-maplecityglass-net-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainvoicemail-l1b[.]thomas-gibson-clyde-enq-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domaindocusign-ac3[.]christina-parsons-charter-comm-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domaindocusign-o4x[.]bhc-credit-services-edl-bayreer-com-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domainonedrive-4um[.]accounting-malitzconstructioninc-co-s-account[.]workers[.]dev- EvilTokens administrator-hosted Cloudflare Workers domain
- Urls:
/api/prt/convert- EvilTokens backend API endpoint to convert a refresh token to a PRT./api/prt/cookie- EvilTokens backend API endpoint to generate a cookie for one-click browser SSO hijack./api/prt/recon- EvilTokens backend API endpoint to obtain a Graph API token and perform reconnaissance.