Extended Rapid Response: Zimperium's On-Device Coverage of the EvilTokens Multi-Brand Phishing Campaign

Extended Rapid Response: Zimperium's On-Device Coverage of the EvilTokens Multi-Brand Phishing Campaign

Sekoia.io's recent research exposes EvilTokens, a widespread Phishing-as-a-Service (PhaaS) kit that runs device-code phishing against Microsoft 365. The campaign uses trusted brand lures (DocuSign, Microsoft 365, Adobe) hosted on disposable Cloudflare Workers infrastructure.

Article content

Instead of harvesting passwords, the kit abuses Microsoft's OAuth device authorization grant: it tricks the victim into approving the attacker's device on the genuine Microsoft sign-in flow, bypassing both credential-phishing defenses and MFA. The page content is AES-GCM encrypted and decrypted in-browser to evade static analysis.

The EvilTokens campaign is significant because:

  • It defeats both passwords and MFA: the victim approves the malicious device on Microsoft's own legitimate page.
  • Sold as PhaaS with disposable Cloudflare Workers infrastructure, making static blocklisting ineffective.
  • Stolen refresh tokens provide persistent access that survives password resets.
  • Entry point is increasingly mobile: links are frequently opened on phones where endpoint controls are weakest.

Article content

Zimperium's Mobile Threat Defense (MTD) detects and blocks the EvilTokens phishing URLs directly on the mobile device, stopping the lure at the entry point before the victim ever reaches the device-code step. On top of this, our research team identified hundreds of new domains actively using this phishing kit. These IOCs can be found in the following Github repository.


Additional Reading:

  1. Rokarolla : Android Banker with Complete Device Takeover Capabilities
  2. World Cup 2026 Mobile Targeted Phishing: The Global Social Engineering Threat
  3. Premium Deception: Uncovering a Global Android Carrier Billing Fraud Campaign




The most effective defence is preventing compromise before user interaction becomes a risk.

Like
Reply

Zimperium Fantastic analysis by the zLabs team. What makes the EvilTokens campaign so dangerous from an architecture perspective is that it targets the trust model of the identity provider itself, rather than trying to steal or crack credentials. When threat actors can abuse legitimate OAuth device authorization flows, our standard conditional access and MFA rules are completely bypassed because the authentication handshake happens on the genuine vendor portal. This proves why securing the endpoint before the token handshake is critical. Relying on Secure Email Gateways (SEGs) is no longer enough when attackers can use client-side AES decryption to completely blind static payload scanners. Real-time, on-device URL vetting is fast becoming the only reliable way to break this specific kill chain.

Like
Reply

To view or add a comment, sign in

More articles by Zimperium

Explore content categories