Act
active
EvilTokens PhaaS disrupted after enabling AI-assisted device code phishing
- Engineer — Plan: Device code phishing industrialization is a signal to audit whether OAuth device code flow is enabled in your Entra ID / identity provider — restrict it to only necessary clients and enforce conditional access policies that block token reuse from unexpected locations.
- SOC/IR — Act: EvilTokens was actively stealing tokens at scale via device code flow; hunt for anomalous device code authentication requests in your identity logs (Entra Sign-in logs, unified audit log) since at least early 2026, and tune detections for device code grants issued to unfamiliar device types or followed by token use from new geographies.
- Leader — Learn: The Microsoft DCU-led disruption illustrates how AI-assisted PhaaS platforms are lowering the bar for credential and token theft campaigns; useful context for the next board or risk-committee briefing on evolving phishing sophistication.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.