EvilTokens hijacks Microsoft 365 accounts without stealing passwords
EvilTokens is a phishing-as-a-service kit that abuses Microsoft’s OAuth device code flow, letting attackers capture valid access tokens after victims complete a legitimate login. By sidestepping password entry, it enables rapid account takeover and BEC campaigns across Microsoft 365 environments.