What happened
On 22 September 2026, Microsoft announced a court-authorised disruption of EvilTokens, one of the most widely used phishing-as-a-service (PhaaS) platforms of the year. Working with partners including Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs, Microsoft seized around 50 websites used to run the service and disabled more than 150 supporting domains. In the UK, the Metropolitan Police arrested two men in connection with the campaign; both have been released on bail while the investigation continues.
Microsoft tracks the group that built, sold and supported EvilTokens as Storm-2992. The kit was sold on Telegram from February 2026 for an initial fee of about $1,500 plus a $500 monthly subscription — putting a sophisticated attack in the hands of criminals with little technical skill.
How device code phishing works
"Device code" sign-in is a legitimate Microsoft feature for devices without a proper keyboard or browser — smart TVs, printers, meeting-room systems. The device shows a short code; you type it at microsoft.com/devicelogin on your phone or laptop, sign in, and the device is connected.
Criminals turn this around. They start the sign-in, receive the code, and send it to you inside a lure. When you enter it and complete MFA, you are not signing yourself in — you are approving their session. They receive valid access tokens for your email, Teams, OneDrive and SharePoint. No password is stolen and no fake login page is involved: every page you see belongs to Microsoft.
The attack chain — step by step
Step 1 — A lure arrives: an invoice, a request for proposal, a shared document, a voicemail, or a "password expiring" warning. EvilTokens offered 44 ready-made themes and used AI to tailor emails to the recipient's role.
Step 2 — You open a link or attachment. A page shows a code with a "Copy code" and "Continue with Microsoft" button. The code is often copied to your clipboard automatically.
Step 3 — You land on the genuine Microsoft device login page, paste the code, and sign in with your password and MFA — or simply confirm, if you are already signed in.
Step 4 — The attacker's system, which has been checking every few seconds, instantly receives your tokens.
Step 5 — The attacker digs in: registering a new device to keep long-term access, creating hidden inbox rules, and using AI to search your mailbox for invoices, payment details and finance conversations.
Step 6 — Your account is used to send convincing fraud and phishing emails to colleagues, customers and suppliers — classic business email compromise (BEC).
GhostCode: the business-to-business version
GhostCode, named by eSentire, did not start with a mass email. Attackers filled in the contact form on a company's website, posing as a procurement officer from a well-known retailer. When a salesperson replied, the "buyer" asked them to sign a non-disclosure agreement and sent a WeTransfer link containing a password-protected HTML file.
Opening it led to a polished document portal showing a device code. Once the victim entered it on Microsoft's real page, eSentire observed the attackers using the stolen token within seconds and completing a full account takeover — including registering devices — in under 80 seconds. A decoy NDA was then displayed so nothing looked wrong.
This is not new — it is industrialised
Microsoft had previously linked device code phishing to Storm-2372, and warned customers about an AI-enabled EvilTokens-aligned campaign in April 2026. What has changed is scale: kits like EvilTokens packaged the whole attack — lures, code generation, token capture and mailbox analysis — into a subscription service.
What you should do
- Only enter a code at microsoft.com/devicelogin if you started the sign-in on a device physically in front of you
- Read the sign-in prompt — check which app or device you are approving
- Verify new "buyers" or partners through a known phone number or official website before opening their files
- Report anything that asked you for a code, even if you already entered it — speed limits the damage
- Type or paste a code from an email, document, chat message or web page into a Microsoft sign-in
- Trust a request just because it lands on a real Microsoft page
- Open password-protected attachments from contacts you have never dealt with before
- Assume MFA protects you — in this attack, you complete MFA for the criminal
No legitimate document, invoice or NDA ever needs a Microsoft device code to open.
What organisations should do
- Block device code flow with Conditional Access wherever possible, and scope any exception tightly (for example, to specific meeting-room devices). Microsoft recommends this directly.
- Enable Safe Links and Entra ID Protection — together they raise high-confidence device code phishing alerts in Microsoft Defender.
- Move towards phishing-resistant MFA (passkeys, FIDO2 keys) and apply sign-in risk policies.
- Alert on suspicious inbox rules and new device registrations after unusual sign-ins.
- On suspected compromise, revoke refresh tokens, disable any attacker-registered devices, and consider temporarily disabling the account — Microsoft notes access tokens can stay valid for up to an hour after revocation.
Sources
Microsoft Security Blog — Unmasking EvilTokens: Getting to the root of device code phishing
Microsoft Digital Crimes Unit — EvilTokens disruption announcement
Microsoft Security Blog — Inside an AI-enabled device code phishing campaign (April 2026)
eSentire TRU — GhostCode: Dissecting a Novel Device Code Phishing Kit
Sekoia TDR — New widespread EvilTokens kit: device code phishing as-a-service
The Hacker News — Microsoft takes down EvilTokens device-code phishing service
Dark Reading — Microsoft disrupts EvilTokens device code phishing service
Microsoft Learn — Block authentication flows with Conditional Access
Microsoft Learn — Token theft playbook