EvilTokens, a phishing-as-a-service platform, leveraged AI to gain access to Microsoft 365 inboxes and analyze the environment for effective next steps, first identified in February 2026.
The vulnerability or weakness
EvilTokens exploited the device authorization grant flow of OAuth 2.0, allowing attackers to gain access to Microsoft accounts without requiring fraudulent login pages.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations face greater risk of data breaches and fraud, impacting operations and potentially leading to financial losses and reputational damage.
Industries affected
The attack primarily affects businesses using Microsoft 365, including enterprises and small to medium-sized enterprises.
Users affected
Employees and business owners are at risk, as the platform can identify key targets and draft convincing fraudulent messages based on real business conversations.
