Checking that a sign-in page belongs to Microsoft is good advice, but it is no longer enough on its own.

Microsoft disclosed EvilTokens, a phishing-as-a-service platform that abused the legitimate Microsoft device-code authentication flow. Microsoft says the operation was linked to more than 12,000 compromised inboxes across more than 10,000 organizations, with Canada among the countries showing the highest concentrations of observed victim activity.

How can a real Microsoft page be part of the attack?

Device-code authentication is legitimate. It is useful for devices such as TVs, printers and meeting-room systems. In a phishing scenario, however, the attacker initiates the authentication request and convinces the victim to enter the attacker's code on Microsoft's genuine sign-in page. The victim may complete normal authentication and MFA while unknowingly authorizing the attacker's session.

A legitimate domain does not make an unexpected authentication request legitimate. Never enter a device code unless you personally initiated the sign-in on a device you recognize.

Why this matters after the inbox is compromised

Microsoft observed stolen tokens being used for email access, malicious inbox rules, reconnaissance and persistence. EvilTokens also incorporated AI capabilities to analyze mailbox activity and identify valuable relationships and financial conversations.

What businesses should do

Block device-code flow where it is not needed. Microsoft recommends doing this where practical and tightly scoping exceptions for devices that require it.

Use phishing-resistant authentication. Stronger authentication reduces reliance on methods attackers can socially engineer.

Revoke sessions during response. A password reset alone may not terminate an already authorized token.

Watch for suspicious inbox rules and sign-ins. Account compromise is often followed by persistence and financial fraud.

CyberEase practical security guidance

Source: Microsoft Threat Intelligence, “Unmasking EvilTokens: Getting to the root of device code phishing,” September 22, 2026.

Simple IT. Strong Security. — CyberEase

Need help strengthening your business security?

CyberEase provides practical IT and cybersecurity support for small businesses, professional offices and clinics.

Free consultation