Unmasking EvilTokens: Getting to the root of device code phishing

Reported by Microsoft Security (Microsoft Threat Intelligence, Microsoft Defender Experts and Microsoft Security Research)

Summary by Cyber Security News22 Sep 2026, 17:00 CEST

About this summary. This is a short, independently written summary of an article first published by Microsoft Security. Cyber Security News did not report or verify the underlying story. Read the original: https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/

What is device code phishing? EvilTokens platform and operations EvilTokens phishing emails Mitigation and protection guidance Microsoft Defender XDR detections Hunting queries Following its emergence in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, providing cybercriminals with AI capabilities for tailoring phishing lures and analyzing compromised inboxes to identify high-value targets.

Read the full article at Microsoft Security →

Source attribution: headline and facts are from Microsoft Security (microsoft.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

UK cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites

Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud

Cybersecurity Awareness Month 2026: Critical Infrastructure Urged to Adopt Cybersecurity 3Rs

Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects

Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises

Microsoft reminds admins to migrate Entra ID users to passkeys