EvilTokens device-code phishing: what Microsoft account holders should do

If you use Outlook.com, Xbox, OneDrive, or any other personal Microsoft account, read this once and keep the habit. Microsoft disrupted EvilTokens, a phishing-as-a-service kit that helped criminals steal access to email inboxes by abusing a real Microsoft sign-in flow called device code.

This is not a “your company IT team should open a ticket” post. It is for people who sign into Microsoft on their own laptop or phone, get weird “verify” emails, and need a plain-English map of what to refuse and what to check.

Microsoft’s Digital Crimes Unit and partners seized EvilTokens infrastructure in September 2026. Microsoft Threat Intelligence tracks the kit’s operators as Storm-2992. Prefer Microsoft’s own write-ups for facts: the Security Blog technical analysis and the On the Issues disruption note. Secondary coverage from Ars or BleepingComputer can help with plain language. For numbers and mechanics, stick to Microsoft.

What happened, in one minute

EvilTokens sold criminals a ready-made phishing toolkit (Microsoft said about a $1,500 start fee and $500 per month on Telegram). Within months of launching in February 2026, Microsoft linked it to more than 12,000 compromised email inboxes across more than 10,000 organizations worldwide, with lots of victim activity in the United States, Canada, the United Kingdom, Australia, India, and France.

The core trick was device-code phishing. Device code is a legitimate OAuth flow meant for gadgets that are awkward to type on (think smart TVs and similar devices). You see a short code, then enter that code on a browser at Microsoft’s real device-login page to finish signing in.

Criminals flipped that around. They started the flow themselves, showed you the code on a fake “verify” page or PDF, and pushed you to paste it on the real microsoft.com/devicelogin site. When you finished password and MFA on Microsoft’s page, you authorized their session, not a device you meant to set up. Your password never had to leave Microsoft’s site. The token did the damage.

After access, EvilTokens offered AI tools that helped criminals skim an inbox, find payment threads, and draft impersonation messages. Microsoft says access can stick around even after a password change if sessions and tokens are not revoked.

What it looks like for a normal person

Expect pressure and urgency, not a polite FAQ:

• An unexpected email, PDF, or HTML attachment about invoices, shared files, password expiration, document signing, voicemail, or “verify your Microsoft account.”
• A page that shows a short code with a Copy code button, then a Continue with Microsoft button that opens the real Microsoft device-login site.
• Instructions to paste the code on microsoft.com/devicelogin (or a similar Microsoft device-login URL) “to unlock your file” or “confirm it is you.”
• Sometimes the code is even copied to your clipboard for you, so paste feels automatic.

The dangerous part is how legitimate the second step looks. You are on a real Microsoft page. MFA may succeed. That is the point. Completing the flow still hands the attacker a token for your account.

Treat any unexpected “paste this code on Microsoft’s device login page” message as hostile. A smart TV you just set up in your living room is a real device-code moment. A random email attachment is not.

What not to do

• Do not open unexpected PDFs or HTML attachments that demand immediate Microsoft verification.
• Do not enter a device code from an email, text, chat, or “secure document” page you did not expect.
• Do not trust a page just because the follow-up tab says microsoft.com. The lure page is what fed you the code.
• Do not assume changing your password alone kicked everyone out. Revoke sessions too.
• Do not dig for malware samples or try to “test” the lure. Curiosity is how people finish the flow.

If you already entered a code (or you are not sure)

1. Go to account.microsoft.com and sign in.
2. Open Security / recent activity (wording varies slightly by account). Review recent sign-ins and devices you do not recognize.
3. Sign out of suspicious sessions / revoke unfamiliar devices.
4. Change your password after you revoke sessions, not instead of revoking them.
5. Turn on the strongest sign-in options you can: authenticator app, passkeys, or other phishing-resistant methods if Microsoft offers them for your account. Prefer those over SMS codes alone.
6. Check Outlook.com inbox rules and forwarding. Look for rules you did not create that hide mail or auto-forward everything.
7. Warn people you email regularly that your account may have been used to send fake “urgent payment” or “please buy gift cards” messages.

If you cannot recover the account, use Microsoft’s account recovery flow and treat linked banking or shopping accounts as needing a careful password and MFA check too.

Everyday habits that actually help

• Pause on any message that wants a device code. If you did not start signing in a new TV or console, stop.
• Prefer passkeys or an authenticator app for your Microsoft account when available.
• Periodically skim recent activity on account.microsoft.com the same way you glance at bank alerts.
• Keep Chrome, Edge, or Safari updated so phishing pages have fewer old-browser assists (Chrome 154 Stable is the current desktop train as of this writing).

Disruption of EvilTokens does not mean device-code phishing vanished. Other kits will copy the pattern. The defense for a home Microsoft account is boring and effective: refuse unexpected codes, check recent activity, revoke weird sessions, use strong MFA.

Bottom line

Microsoft disrupted EvilTokens (Storm-2992), an AI-assisted phishing kit that abused device-code sign-in to steal Microsoft account access without stealing your password, with more than 12,000 compromised inboxes reported (Security Blog, On the Issues). For Outlook.com and other personal Microsoft accounts: never enter a device code from an unexpected email or “verify” page, check recent activity at account.microsoft.com, revoke suspicious sessions, change the password, and turn on strong MFA or passkeys. That is the whole job.

Image: Microsoft Digital Crimes Unit EvilTokens disruption blog header (Microsoft On the Issues).