Microsoft: EvilTokens phishing compromised more than 12,000 inboxes

Microsoft says the EvilTokens service tricked people into approving attacker-controlled sign-ins with device codes. Do not enter a code from an unexpected message, even if the link opens Microsoft’s real sign-in page.

Who should care and what to do today

This matters to people and organizations using Microsoft work or school accounts, especially anyone who receives an unexpected request to enter a device code. Microsoft says it observed EvilTokens activity in industries including wholesale distribution, construction, financial services, real estate, higher education, and healthcare. It also reported activity in the United States, Canada, the United Kingdom, Australia, India, and France.

You may be facing this type of scam if a message asks you to open a link or attachment and then enter a short code at a Microsoft sign-in page. The message could mention an expiring password, an invoice, a shared file, a document signature, or a business proposal.

If you did not start the sign-in yourself, do not enter the code or approve the request. Close the page and report the message through your usual work or school process. If you already entered the code, contact your account administrator immediately and explain exactly what happened.

How device-code phishing works

Microsoft describes device-code phishing as the misuse of a real sign-in feature. Device-code sign-in is designed for equipment such as smart TVs, printers, Teams devices, and conference equipment that cannot show a normal sign-in screen. The device displays a short code, and the user enters it in a browser on another device.

In the scam, the attacker starts the sign-in request and places the code inside a phishing message. The victim may then be sent to the real Microsoft sign-in website. That site is genuine, but entering the code can approve the attacker’s session rather than the victim’s intended device.

The victim may also be asked for a password and multifactor authentication, or MFA. MFA is an extra sign-in check, such as an app approval or security key. Microsoft says EvilTokens could obtain a sign-in token, which is temporary proof that an account has authenticated. Attackers could then read email, create hidden inbox rules, send messages from the account, and search for valuable information.

Why ordinary work messages can be part of the lure

Microsoft calls EvilTokens a phishing-as-a-service platform. That means it supplied other criminals with ready-made tools for running phishing campaigns. Microsoft says the service offered many message and webpage templates, used artificial intelligence to tailor lures, and helped examine compromised inboxes for valuable targets.

The reported themes included invoices, requests for proposals, shared files, cloud services, password notices, document signing, voicemail, and electronic fax messages. A message that fits your job or arrives during a busy workday can still be a trap. The key question is whether you expected to sign in to a device that uses a code.

Microsoft says EvilTokens activity compromised more than 12,000 inboxes in over 10,000 organizations worldwide. Microsoft’s Digital Crimes Unit, working with partners, facilitated a coordinated disruption of infrastructure used to operate the service. The broader device-code phishing technique still calls for the same basic response: do not approve an unexpected sign-in.

What account administrators should check

Microsoft recommends blocking device-code sign-ins wherever they are not needed. If an organization must use them for specific Teams devices, Microsoft says administrators should limit the exception to those device accounts.

Administrators should review alerts for unusual device-code sign-ins, new device registrations, suspicious inbox rules, and unusual email access. Microsoft also recommends anti-phishing controls, link scanning, sign-in risk policies, and phishing-resistant sign-in methods such as security keys or passkeys where available.

If a user may have approved a fraudulent code, Microsoft recommends following its compromised-account guidance. Depending on the situation, that can include temporarily disabling the account, revoking sign-in sessions, forcing a new sign-in, and checking for hidden inbox rules or other account changes. An administrator should handle these steps because they can interrupt normal work.

Primary source

This article is based on Microsoft’s Security Blog report, “Unmasking EvilTokens: Getting to the root of device code phishing,” published September 22, 2026: https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/. Claims about EvilTokens, affected organizations, and recommended administrator controls come from that report. Practical user advice is general guidance based on the described attack. Read the complete original source.

Article history: Published Sep 22, 2026 at 1:22 pm EDT. Updates and corrections are noted here when material facts change.