Extended Rapid Response: Zimperium's On-Device Coverage of the EvilTokens Multi-Brand Phishing Campaign
Sekoia.io's recent research exposes EvilTokens, a widespread Phishing-as-a-Service (PhaaS) kit that runs device-code phishing against Microsoft 365. The campaign uses trusted brand lures (DocuSign, Microsoft 365, Adobe) hosted on disposable Cloudflare Workers infrastructure.
Instead of harvesting passwords, the kit abuses Microsoft's OAuth device authorization grant: it tricks the victim into approving the attacker's device on the genuine Microsoft sign-in flow, bypassing both credential-phishing defenses and MFA. The page content is AES-GCM encrypted and decrypted in-browser to evade static analysis.
The EvilTokens campaign is significant because:
Zimperium's Mobile Threat Defense (MTD) detects and blocks the EvilTokens phishing URLs directly on the mobile device, stopping the lure at the entry point before the victim ever reaches the device-code step. On top of this, our research team identified hundreds of new domains actively using this phishing kit. These IOCs can be found in the following Github repository.
Additional Reading:
The most effective defence is preventing compromise before user interaction becomes a risk.
Zimperium Fantastic analysis by the zLabs team. What makes the EvilTokens campaign so dangerous from an architecture perspective is that it targets the trust model of the identity provider itself, rather than trying to steal or crack credentials. When threat actors can abuse legitimate OAuth device authorization flows, our standard conditional access and MFA rules are completely bypassed because the authentication handshake happens on the genuine vendor portal. This proves why securing the endpoint before the token handshake is critical. Relying on Secure Email Gateways (SEGs) is no longer enough when attackers can use client-side AES decryption to completely blind static payload scanners. Real-time, on-device URL vetting is fast becoming the only reliable way to break this specific kill chain.