Get on Slack/Teams RSS
Last updated: August 19, 2026 at 1:47 AM UTC
All 741 Vulnerability 286 Breach 129 Threat 319 Defense 7
Tag: device-code (3 articles)Clear
threat
2026-07-14

Exposed server unmasks three Evilginx phishing crews stealing Microsoft 365 sessions

A phishing operator left a Python web server exposed with directory listing on, letting researchers at Lexfo lift the entire toolkit and pivot to two more operators running three Microsoft 365 phishing campaigns. Each used a custom fork of the open-source Evilginx proxy to steal live session cookies and tokens, defeating multi-factor authentication by relaying the real login. The largest campaign ran over a year, logging 218 captured accounts, mostly corporate mailboxes, and a token file left in a public repository held 97 live Microsoft tokens. The report stresses two different MFA-bypass methods appeared, one proxying the real login and one abusing the device-code flow, which require different defenses to stop.

evilginxm365aitmdevice-codesession-theft
Check
Assess your Microsoft 365 defenses against both adversary-in-the-middle proxying and device-code abuse, hunt for suspicious token use and session reuse from unusual locations, and review Conditional Access coverage of the device-code flow.
Affected
Microsoft 365 organizations, especially corporate mailboxes; Evilginx-style proxies steal live session tokens to bypass MFA, and passkeys stop the proxy method but not the separate device-code abuse technique.
Fix
Enforce phishing-resistant authentication like passkeys against proxy phishing, use Conditional Access to block or limit the device-code flow, revoke suspicious sessions and tokens, and monitor sign-in logs for token reuse across locations.
threat
2026-07-10

Forg365 phishing service uses AI to steal Microsoft 365 accounts and stay in

A new phishing-as-a-service platform called Forg365 is built to steal Microsoft 365 accounts, combining adversary-in-the-middle and device-code phishing with AI-generated lures created directly in its control panel. Researchers at ZeroBEC found the panel lets operators build campaigns, configure malicious OAuth apps, generate and refine phishing emails with AI, and monitor compromised mailboxes for keywords, all in one place. It also ships a browser extension that silently refreshes session cookies through an OAuth flow, giving attackers ongoing access without re-authenticating. The operators deliver lures posing as business documents, using legitimate email-sending infrastructure to slip past filters. The researchers note AI is lowering the cost of both writing phishing content and building phishing platforms.

forg365phishing-as-a-servicem365aitmdevice-code
Check
Hunt for adversary-in-the-middle and device-code phishing against Microsoft 365, review OAuth app consents and unexpected browser extensions, and check for mailbox rules or session tokens giving attackers persistent access.
Affected
Microsoft 365 users targeted by business-document lures; Forg365 captures session tokens to bypass multi-factor authentication and uses a browser extension to keep access alive even after passwords or sessions are reset.
Fix
Enforce phishing-resistant methods like passkeys, apply Conditional Access to limit device-code and token sign-ins, review and restrict OAuth app consents and browser extensions, and monitor for anomalous token use.
threat
2026-04-01

EvilTokens phishing kit commoditizes Microsoft device code attacks for business email compromise

A new phishing-as-a-service kit called EvilTokens is being sold on Telegram, turning OAuth device code phishing against Microsoft accounts into a turnkey attack. Victims receive emails with PDFs or HTML files containing QR codes or links to pages impersonating Adobe, DocuSign, or SharePoint. The kit captures Microsoft authentication tokens in real time - bypassing MFA - and gives attackers persistent access for business email compromise. The developer says Gmail and Okta support is coming next.

microsoftoauthphishingdevice-codebecmfa-bypass
Check
Review your Microsoft Entra ID logs for unusual device code authentication flows, especially from unfamiliar locations or devices.
Affected
Any organization using Microsoft 365 with users who may click on phishing emails disguised as document-sharing notifications.
Fix
Restrict or disable the device code authentication flow in Microsoft Entra ID conditional access policies if your organization doesn't need it. Deploy phishing-resistant MFA (FIDO2 hardware keys). Train finance, HR, and sales teams to recognize fake document verification pages. Monitor for anomalous token grants in Entra ID sign-in logs.