EvilTokens turns a Microsoft sign-in into a route to corporate email fraud. The phishing kit, first seen in February 2026, tricks people into approving an attacker's login through a real device code process without handing over a password.
EvilTokens turns a Microsoft sign-in into a route to corporate email fraud.
The phishing kit, first seen in February 2026, tricks people into approving an attacker's login through a real device code process without handing over a password.
The lure usually arrives as an urgent email about an invoice, shared file, document signature or expiring […]
The page is ready to read now. The fuller skim-friendly version will appear here automatically.
EvilTokens turns a Microsoft sign-in into a route to corporate email fraud. The phishing kit, first seen in February 2026, tricks people into approving an attacker's login through a real device code process without handing over a password. The lure usually arrives as an urgent email about an invoice, shared file, document signature or expiring […]
Open the app view to save this story, compare related coverage, and continue from the same source.