How EvilTokens Turbocharges Old School Phishing with AI

What it is

EvilTokens, a phishing-as-a-service kit ($1,500 + $500 maintenance, sold on Telegram) built around device code phishing — abuse of the OAuth device authorization flow (the same flow you use to log a smart TV into Netflix). Huntress observed it across 344 organizations in five countries; first blips on Feb 19 and Feb 24, then a 16-day flood starting March 2.

How it works

The attacker initiates the device authorization flow themselves, then sends the victim a lure containing the resulting code. The victim clicks, enters the code, and completes MFA normally — but authorizes the attacker's session rather than their own. The result is a fully valid OAuth/session token with no password stolen, no malware, and MFA legitimately satisfied. EvilTokens generated the device code dynamically the moment the victim hit the phishing page, closing the timing window that limited earlier device-code attacks. After token capture, the platform scanned the victim's inbox, calendar, and documents to auto-draft wire-fraud follow-ups in the victim's own voice within minutes.

Why defenses failed

This is the part the summary understates and the reason to act: the attack presents no bad indicators.

• Lure emails passed cleanly through Cisco Secure Email, Trend Micro, and Mimecast.
• URLs were clean; the authentication flow was genuinely Microsoft's; MFA succeeded correctly.
• Traffic was relayed through Railway, a legitimate PaaS, so domain blocklists and spam filters had nothing to flag.

The detection signal Huntress actually caught it on: one cloud IP hitting ~50 organizations in a single week, with hundreds of login events routed through the same Railway infrastructure — a cross-tenant anomaly, not a per-message one.

What to do

The page states no patches or commands. The actionable takeaways it does give:

• Hunt on the cross-org / cross-tenant login pattern (single Railway-hosted IP authenticating many unrelated orgs), since content and URL filtering will not fire.
• Treat device code / device authorization flow as a first-class risk surface — user training does not help, because the user does everything correctly.
• Related PhaaS kits using comparable infrastructure to watch for: Tycoon2FA, BlueKit, Kali365.

Caveats

Huntress provides no CVE, no patch, and no configuration guidance — the flow being abused is working as designed, so mitigation is detection and conditional-access policy rather than a fix. The IP-concentration signal is Huntress's own observation from this campaign, not a durable IOC.