EvilTokens: large-scale phishing targeted Microsoft accounts

Original reporting date: 2026-09-22 · Source: BleepingComputer

What happened

An international disruption targeted the EvilTokens phishing service, linked to thousands of compromised Microsoft accounts and abuse of device-code flows.

Why it matters to businesses

Modern identity attacks can trick users into authorizing sessions even where MFA is enabled.

Practical IT checklist

• Audit OAuth applications and consent grants.
• Restrict device-code flow where it is not needed.
• Revoke suspicious sessions and train users to recognize fake login prompts.

Source and full reporting: BleepingComputer ↗

Original VALUE360 editorial summary and practical commentary; not a reproduction of the source article.