EvilTokens phishing: why a genuine Microsoft sign-in page can still put your business at risk

What has changed?

Microsoft reports that EvilTokens, a phishing service first seen in February 2026, helped criminals compromise more than 12,000 inboxes across over 10,000 organisations worldwide. The UK was among the countries with the highest concentrations of observed victim activity.

Rather than building attacks themselves, criminals could buy access to ready-made email templates, automated infrastructure and AI tools. These tools helped tailor messages to particular roles and search compromised inboxes for valuable targets.

Microsoft’s Digital Crimes Unit worked with partners to disrupt infrastructure supporting the service. That is a significant intervention, but businesses should still address the underlying sign-in technique that EvilTokens exploited.

How the trick works

Device code authentication is a legitimate way to sign in on equipment where typing is difficult, such as a television or conferencing device. The equipment displays a short code, which the user enters into a browser on another device to approve access.

In this attack, the criminal starts that process. A deceptive email, perhaps about an invoice, shared document or expiring password, leads the recipient to a page displaying a code. The recipient is then directed to Microsoft’s genuine device sign-in page.

Entering the code and approving the request authorises the criminal’s session rather than the device the employee thinks they are using. The attacker can gain access without stealing the employee’s password. Even completing multifactor authentication (MFA) can be part of approving that unwanted access.

The important distinction is that a genuine sign-in website does not make the request trustworthy. Staff also need to understand what they are authorising and who initiated it.

Why this matters to smaller businesses

An email account contains more than messages. It can reveal customer relationships, internal responsibilities and sensitive business information. EvilTokens allowed attackers to read and extract email, then use its contents to make further phishing messages more convincing.

Criminals also created inbox rules to hide communications. In some cases, they registered additional devices to maintain access. Microsoft observed some device registrations within ten minutes of compromise.

This makes the issue relevant to everyday business operations, not just IT teams. The reported campaigns affected sectors including construction, wholesale distribution, financial services, property and healthcare. Familiar business requests were central to the deception.

What to do next

Ask your IT provider whether your organisation needs device code authentication. Microsoft recommends blocking it wherever possible. Where Teams equipment depends on it, have your provider apply Microsoft’s specific Conditional Access guidance rather than leave broad access available.

Brief staff on this particular warning sign: an unexpected email or document asking them to copy a code into a Microsoft sign-in page. Encourage them to question the request even when the web address is genuine.

Keep MFA, but do not treat it as a complete defence. Ask your provider to review email filtering, spoofing protections and connector settings alongside access controls. Microsoft also supplies Defender detection and investigation guidance that security teams can use when reviewing suspicious activity.