Unmasking EvilTokens: Getting to the root of device code phishing

In this article 1. What is device code phishing? 2. EvilTokens platform and operations 3. EvilTokens phishing emails 4. Mitigation and protection guidance 5. Microsoft Defender XDR detections 6. Hunting queries Following its emergence in February 2026, EvilTokens quickly became one of the most...

Inside an AI‑enabled device code phishing campaign

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. References 5. Learn more Microsoft Defender Security Research has observed a widespread phishing campaign leveraging the device code authentication flow to compromise organizational...

Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentication

Amazon on Friday said it flagged and disrupted what it described as an opportunistic watering hole campaign orchestrated by the Russia-linked APT29 actors as part of their intelligence gathering efforts. The campaign used "compromised websites to redirect visitors to malicious infrastructure...