The subscription cost $1,500 to start and $500 a month after that. For the money, a criminal customer of EvilTokens got 44 ready-made email themes, hosting on services their target's security team already trusts, and an AI assistant that read the victim's stolen mailbox and worked out who in the company could move money. Microsoft says the platform compromised more than 12,000 inboxes at over 10,000 organizations since it appeared in February, and that its Digital Crimes Unit has now helped take the infrastructure behind it offline.
Microsoft Threat Intelligence, Microsoft Defender Experts and Microsoft Security Research published the analysis on 22 September, alongside the disruption. They track the operator selling and supporting the kit as Storm-2992, who advertised it on Telegram with a store bot, a referral scheme paid in cryptocurrency and video tutorials.
A login code is the new password
EvilTokens does not try to steal a password, which is why multifactor authentication did not stop it. It abuses device code authentication, the legitimate sign-in path built for equipment with no proper keyboard, such as smart TVs, printers and conference room hardware. Normally the device shows you a short code and you type it into a browser somewhere else to approve the sign-in. Because approval happens on a different device, nothing binds the code to the session that asked for it.
The kit puts itself in the middle of that. A lure with a deadline attached, "Action Required: Password Expiration" being one Microsoft observed, sends the target to a page that quietly asks Microsoft for a live device code and shows it to them. The page copies the code to their clipboard, then opens the genuine microsoft.com/devicelogin portal. The victim pastes it into a real Microsoft page and approves what looks like a real request. In the background the page polls the attacker's own endpoint every few seconds until the approval lands, and the criminal now holds a valid token. Researchers at Huntress separately observed the same lure set using construction bid proposals, partnership agreements and compensation notices.
What the AI actually does after the break-in
This is the part that scales. With a token in hand, EvilTokens customers used its AI feature to sort compromised users and surface the ones in finance, executive or administrative roles, then queried Microsoft Graph to map the organization's structure and permissions while the token was still valid. Persistence came in two shapes: inbox rules created to hide the attacker's own correspondence, and in some cases registering a new device to mint a Primary Refresh Token, which is far harder to shake off. Microsoft saw device registration happen within ten minutes of compromise in some intrusions, and in others the operators waited hours before touching anything.
The delivery chain was built to survive email filtering. Redirects ran through compromised legitimate domains and serverless platforms including Vercel, Cloudflare Workers and AWS Lambda, so the traffic blended into ordinary enterprise cloud requests. Fake CAPTCHA pages sat in front of the phishing content to stall automated scanners. Victim concentrations were highest in the United States, Canada, the United Kingdom, Australia, India and France, across wholesale distribution, construction, financial services, real estate, higher education and healthcare.
Turn device code flow off, and scope the exception
Microsoft's recommendation is blunt: block device code flow wherever you can. Where Teams hardware genuinely needs it, scope the exception to those specific Teams device resource accounts and exclude the Device Registration Service resource from the Conditional Access policy covering them. Beyond that, audit inbox rules that move or hide mail, and review recent device registrations rather than trusting that an MFA prompt means a human approved it. Disruptions buy time rather than ending a market, as a phishing kit that rebuilt 700 pages after an FBI takedown showed this month. Device code abuse is also not new territory for well-resourced actors: Amazon disrupted a Russian state campaign using the same flow in February.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.