Search — “EvilTokens”

Huntress analyzed three phishing kits (EvilTokens, Knight Office, Kali365) targeting Microsoft 365 tokens through device-code phishing, adversary-in-the-middle relays, and token theft/replay, bypassing passwords and MFA. EvilTokens abused the Railway PaaS for token harvesting and replay. Attackers frequently register rogue devices for persistence. Hunt for device-code authentications, sign-ins from unfamiliar cloud infrastructure, automated token refresh, new device/auth method registrations, and mailbox forwarding rules.

Huntress describes attackers using passkeys as phishing bait, impersonating IT staff to push victims into alternate authentication flows. Huntress tracked the EvilTokens device-code phishing campaign hitting 344 organizations across five countries in about 16 days, where victims completed MFA on a real Microsoft page and the attacker obtained a valid session. Hunters should watch for newly registered authentication methods, device-code sign-ins, inbox rules, OAuth app grants, and forwarding addresses after successful sign-ins.