New widespread EvilTokens kit: device code phishing as-a-service

Reported 31 Mar 2026 by otx · Severity: medium

EvilTokens is a new Phishing-as-a-Service offering a turnkey Microsoft device code phishing kit. It enables attackers to harvest access and refresh tokens, granting unauthorized access to victims' Microsoft accounts. The kit supports post-compromise operations, allowing data exfi