On September 22, 2026, Microsoft announced that its Digital Crimes Unit, working with partners, had disrupted EvilTokens, a phishing-as-a-service kit that, per Microsoft, "compromised more than 12,000 inboxes" at "over 10,000 organizations worldwide" since it appeared in February 2026. The kit sold for $1,500 plus $500 a month. Per press reports, the seizure was authorized by the U.S. District Court for the Eastern District of Virginia, the same federal district our McLean office sits in, and the Metropolitan Police in London arrested two men in September. Good news, and Microsoft deserves credit for it. The reason we are writing about it is what the kit did: the victims signed in on the real Microsoft page, passed real MFA, and the mailboxes still fell.
How device code phishing works, in plain English
Microsoft 365 has a sign-in method built for devices with no keyboard: smart TVs, printers, conference-room screens. Per Microsoft, "Device code authentication, a legitimate OAuth flow designed for devices with limited interfaces," works by showing you a short code on the device and asking you to type it into microsoft.com/devicelogin on your phone or laptop. You sign in there, and the device gets a token.
EvilTokens turned that around. In Microsoft's words: "Instead of a legitimate device requesting access, the threat actor initiates the flow and provides the user with a code through a phishing lure." The email says something like "Action Required: Password Expiration," or a document is waiting for signature, a voicemail, an eFax; the kit offered 44 lure themes, and Huntress, cited in Microsoft's post, saw construction bid proposals and partnership agreements as well. You click, the kit generates a live code on the spot, opens the real microsoft.com/devicelogin page, and asks you to type the code. If you are already signed in to Microsoft 365 on that browser, Microsoft says "simply pasting the code and confirming the request instantly authenticates the threat actor's session." No password prompt, no MFA prompt, because you already passed both earlier that day. If you are not signed in, you get the normal password and MFA prompts, you pass them, and the token still goes to the attacker. Microsoft describes the trick as "decoupling authentication from the originating session." The MFA worked exactly as designed. It just approved the wrong session.
Once the attacker holds the token, per Microsoft, "Stolen tokens are used for email exfiltration and persistence, often through the creation of malicious inbox rules that conceal communications." Microsoft's response guidance says to revoke the user's refresh tokens, and Microsoft's Digital Crimes Unit, as quoted by Help Net Security, notes that access "could persist even after a password reset if the associated sessions and tokens were not also revoked."
What the AI did with the mailbox
This is the part that should worry an owner more than the sign-in trick. Per Microsoft, "EvilTokens enabled threat actors to utilize AI assistants to sift through victim mailbox activity and engineer a phishing message based on the accessible email content," and the attackers "reviewed and filtered for high-value targets," which Microsoft defines as "those in financial, executive, or administrative roles." SpyCloud, which contributed its own recaptured victim data to the operation, relays a Sekoia finding that "the platform automatically pulls up to 5,000 recent emails using the Microsoft Graph API, analyzes the victim's environment, identifies the best opportunities for BEC attacks, and even crafts custom BEC email messages." Cloudflare, which banned hundreds of the kit's domains and Workers projects from its network, describes "an AI coach that guided criminals on topics like US tax documents, Business Email Compromise, and formats of typical invoice and accounting related correspondence."
So the product was not "steal a password." The product was "read the bookkeeper's last 5,000 emails, find the vendor who is owed money, and write the email that changes the bank account." That is the crime the FBI counted at 24,768 complaints and $3.05 billion in losses in 2025, before this kit existed.
Who got hit
Microsoft lists the affected industries as "wholesale distribution, construction, financial services, real estate, higher education, and healthcare," with the United States listed first among the countries with the highest concentration of victims. SpyCloud counts "at least 8,708 unique victim accounts" across "6,585 unique corporate email domains spanning 79 countries," where "corporate" means not free webmail. Our reading, and it is ours, not theirs: 8,708 accounts on 6,585 domains works out to about 1.3 mailboxes per domain. That looks less like a kit that emptied big companies and more like one that took one or two inboxes each from thousands of organizations, many of them likely small, and one inbox is enough when it belongs to the person who handles invoices. SpyCloud also notes the timing: session compromises "peaked during the regular North American workday," 9am to 5pm US Eastern, and "only 5.4% of victims had their sessions captured on a Saturday or Sunday." The attackers kept business hours because their targets did.
A second kit shows how the lure reaches a business that thinks it is careful. eSentire documented GhostCode on September 15: the actors "posed as a procurement officer for BJ's Wholesale Club and initiated contact via a web sales contact form with a generic, benign message." A reply from bjssourcing[.]com, a lookalike domain registered 15 days earlier, promising an NDA to sign, then an email with a WeTransfer link to a password-protected HTML file, then the device code page. Per eSentire, the kit "completed three device registrations and obtained a Primary Refresh Token in 78 seconds," and eSentire found "over 30 similar domains impersonating US-based distributors, manufacturers, warehousing, and other companies" registered in August 2026, which it says suggests a possible broader ongoing campaign targeting service providers. The target is whoever answers your sales inbox. That person is supposed to open messages from new customers.
What to do about it
There are four moves here, and we will be plain about which ones are ours and which are yours.
First, turn the device code flow off unless you need it. Microsoft's own guidance is blunt: "Only allow device code flow where necessary. Microsoft recommends blocking device code flow wherever possible." Per Microsoft Learn, security defaults block device code flow, and new Microsoft Entra tenants created on or after July 1, 2026 get that from day one. If your tenant runs Conditional Access instead of security defaults, which is common once a business has Business Premium or Entra ID P1, you block it yourself: a Conditional Access policy using the Authentication flows condition with Device code flow selected and Block access as the control, run in report-only mode first and then turned on. This is tenant configuration, not email filtering. It is the kind of item our SaaS security posture report covers for customers in their first 90 days, alongside MFA coverage, admin accounts, forwarding rules, and third-party app permissions; if you do not work with us, ask whoever manages your tenant to do it this week.
Second, alert on new inbox rules. Microsoft recommends you "create alerting of suspicious inbox-rule creation to quickly identify and triage evidence of business email compromise." A rule that quietly moves the accountant's replies to an obscure folder is the tell.
Third, move toward phishing-resistant sign-in. Microsoft recommends "phishing-resistant authentication methods such as FIDO Tokens, or Microsoft Authenticator with passkey," and advises avoiding telephony-based MFA, meaning SMS and voice-call codes. Microsoft's 2025 Digital Defense Report says "more than 97% of identity attacks are password attacks" and that phishing-resistant MFA "can stop over 99% of this type of attack," meaning password attacks, not device code phishing. Our reasoning: Microsoft lists blocking device code flow and phishing-resistant sign-in as separate recommendations, and because the device code sign-in happens on a real Microsoft page, a passkey can complete it too. That is why the first move comes first; phishing-resistant sign-in closes the door most credential-stealing kits use.
Fourth, and this is our part: the lure itself. Both kits reach the victim by email; GhostCode opened with a contact-form note, but the link that mattered arrived in a follow-up email. Our Managed Email Security runs Check Point Email Security connected by API with no MX change, which per Check Point inspects mail "after they have been scanned by Microsoft servers, but before they reach the user's mailbox," in Prevent (Inline) mode, which per Check Point "scans the emails prior to delivery to the user." Per Check Point's documentation, the anti-phishing engine "analyzes various components of an email, such as attachments, links, sender reputation, domain analysis, OCR, URLs behind QR code, and many more," it checks whether a newly registered sender domain "resembles your partner domain(s)," which is aimed at exactly the bjssourcing pattern when the impersonated company is one you already correspond with, and click-time protection replaces links so that at the moment of the click, per Check Point, it "emulates the website to detect zero-day phishing websites." We tune those engines for your organization, run the quarantine, and investigate what staff report.
We are not going to tell you a filter would have caught EvilTokens. We have not seen a published test of that, the landing page is Microsoft's own, and Microsoft's own benchmark reports that Defender missed 221 high-severity threats per 1,000 protected users from May through July 2026, the best result in the comparison it published. What we will say is that each of these attacks needs a message to reach a person, that the message carries at least some of the signals a phishing engine is built to read, such as a sender domain registered two weeks ago or a lookalike company name, and that a second layer plus a person reviewing what got through shortens the odds. And one more thing Microsoft's Digital Crimes Unit says, as reported by Help Net Security: independently verify requests to change payment information or redirect funds through a trusted second channel. A phone call to the number you already had beats a filter.
See what is reaching your inboxes now
Our free two-week email security assessment connects the platform in Monitor only mode, which per Check Point "provides visibility into the cloud-hosted email" and, the way we run the assessment, does not quarantine or block mail, so your current filter keeps working. Each business day we review what it flagged against what was delivered: the password-expiration lures, the document-signing notices, the RFQs from a domain registered two weeks ago. At the end you get a written report and a walkthrough with your own examples, and you keep the report whether or not you sign.
The year-end offer
Managed Email Security is $8 per user per month, license plus fully managed service. Through December 31, 2026, new customers who sign a 12-month agreement get 20% off, which is $6.40 per user per month; registered 501(c)(3) nonprofits get 30% instead, $5.60. New customers only, no onboarding fee, and the SaaS security posture report, device code flow included, within your first 90 days at no charge. Full terms are in the year-end offer post, and the service is described on our services page.
We work with small and medium businesses and nonprofits nationwide, including Washington DC, Northern Virginia, and Maryland. To start the free assessment, book a free 15-minute call.
Sources: Microsoft Security blog, "Unmasking EvilTokens: getting to the root of device code phishing" (Sept 22, 2026); Microsoft On the Issues post on the EvilTokens disruption (Sept 22, 2026), as reported by Help Net Security, The Hacker News, and BleepingComputer; SpyCloud, "See No EvilTokens: Disrupting the EvilTokens PhaaS Platform" (Sept 22, 2026, citing Sekoia); Cloudflare, "Cloudflare participates in global operation to disrupt EvilTokens Phishing-as-a-Service" (Sept 22, 2026); eSentire Threat Response Unit, "GhostCode: dissecting a novel device code phishing kit" (Sept 15, 2026); Microsoft Learn: Block authentication flows with Conditional Access policy (Apr 2026), Conditional Access authentication flows (Mar 2026), Security defaults in Microsoft Entra ID (Jun 2026); Microsoft Digital Defense Report 2025 (Oct 2025); FBI IC3 2025 Internet Crime Report; Check Point Email Security administration guide (Anti-Phishing engine, Click-Time Protection, Email Protection modes).
