Sekoia.io23h ago
#TDR analysts uncovered an emerging Phishing-as-a-Service (#PhaaS) platform called #EvilTokens, which offers device code phishing pages and AI-augmented features to automate and scale #BEC workflows.
⬇️
https://buff.ly/RvF5Kux
crep1x23h ago

In early March 2026, we uncovered #EvilTokens, a new #PhaaS offering device code phishing pages and AI-driven features to automate and scale BEC workflows.

Part 1 of our analysis provides a technical analysis of the EvilTokens kit ⬇️

https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/

Rapidly adopted by cybercriminals, we already observed multiple EvilTokens cases in @sekoia_io 's telemetry, and hunted various attachments that delivered its pages worldwide.

Part 2 will focus on the AI-augmented pipeline that significantly facilitates and scales BEC fraud.

The Threat Codex1d ago
New widespread EvilTokens kit: device code phishing as-a-service – Part 1
#EvilTokens
https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/
New widespread EvilTokens kit: device code phishing as-a-service - Part 1

Uncover the new sophisticated EvilTokens device code phishing as-a-service, with AI-augmented features facilitating BEC fraud

Sekoia.io Blog
CyberVeille.ch1d ago

📢 EvilTokens : nouveau kit PhaaS de phishing par device code Microsoft découvert en mars 2026
📝 ## 🔍 Contexte

Rapport publié par Sekoia Threat Detection & Research (TDR) le 30 mars 2026, initia...
📖 cyberveille : https://cyberveille.ch/posts/2026-03-30-eviltokens-nouveau-kit-phaas-de-phishing-par-device-code-microsoft-decouvert-en-mars-2026/
🌐 source : https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/
#BEC #EvilTokens #Cyberveille

EvilTokens : nouveau kit PhaaS de phishing par device code Microsoft découvert en mars 2026

🔍 Contexte Rapport publié par Sekoia Threat Detection & Research (TDR) le 30 mars 2026, initialement distribué en privé le 25 mars 2026. L’analyse porte sur EvilTokens, un nouveau kit de Phishing-as-a-Service (PhaaS) découvert en mars 2026 via la surveillance de communautés cybercriminelles axées sur le phishing. 🎯 Description de la menace EvilTokens est un kit PhaaS clé en main ciblant Microsoft 365 via la technique de device code phishing, exploitant le flux OAuth 2.0 Device Authorization Grant. Contrairement aux plateformes AitM classiques, EvilTokens incite les victimes à entrer un code utilisateur sur la page légitime de Microsoft, permettant à l’attaquant de récupérer des access tokens et refresh tokens valides.

CyberVeille
The Threat Codex3d ago
Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
#EvilTokens #Railway
https://www.huntress.com/blog/railway-paas-m365-token-replay-campaign
Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure | Huntress

Railway PaaS is being weaponized as a clean token replay engine in an active AiTM and device code phishing campaign impacting 268+ M365 organizations and 100+ MSPs.

Huntress