The architecture of account exploitation is undergoing a profound metamorphosis, as adversaries increasingly eschew traditional subversion in favor

Follow us on social media at @HackRead

AI "vibe coding" and the EvilTokens PhaaS platform are supercharging device code phishing to bypass Microsoft 365 MFA. Secure your network today!

Back in April of this year, an AI-powered phishing campaign known as EvilTokens took the spotlight in the infosec world. While the term…

EvilTokens phishing hides takeover clues until browser execution leaving SOC teams needing deeper visibility to validate threats faster and reduce account risk.

At a glance Details Actor or group ARToken operators; assessed as an EvilTokens affiliate panel Activity type Phishing-as-a-service (PhaaS) with device code phishing and token theft Targets Micros…

At a Glance Attribute Details Actor or Group Storm-2992 and associated cybercrime subscribers Activity Type Phishing-as-a-Service, device code phishing, AI mailbox analysis, BEC Targets or Victims…

Microsoft disrupted EvilTokens after the AI-powered phishing service compromised 12,000 inboxes across 10,000 organisations and enabled complex financial fraud.

The password is no longer the main barrier: EvilTokens made users themselves confirm access for attackers on a genuine Microsoft page, then handed its clients working tokens. Over several months, …