# How EvilTokens Turbocharges Old School Phishing with AI

EvilTokens PhaaS abused Microsoft device code flow to phish valid session tokens from 344 organizations, bypassing MFA without stealing passwords.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Entra
- Analysis by: Huntress
- Disclosed: 2026-05-11
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/device-code-phishing-ai-mfa-bypass
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-device-code-phishing-ai-mfa-bypass
- Tags: area:cloud domain:cloud impact:ato impact:data-leak impact:mass-exploit kind:incident platform:threat-intel sev:high tech:azure tech:oauth technique:recon vuln:account-takeover vuln:auth-bypass vuln:mfa-bypass

**Target:** Microsoft Entra device code authentication flow / OAuth device authorization grant
**Root cause:** Device code flow lets an attacker initiate authentication and trick the victim into entering the attacker's device code, yielding a valid session token bound to the attacker's session. Legitimate flow, no malware or password theft needed.
**Steps:**
1. Attacker initiates device code authentication flow, obtaining a device code and user code.
2. Attacker sends phishing email (DocuSign, bid proposals, fake Microsoft forms) with a link to the legitimate device login page.
3. Victim clicks link and enters the standard authentication code, completing MFA on the attacker's session.
4. Attacker receives a fully valid session/refresh token for the victim's account.
5. Platform scans inbox, calendar, documents and uses AI to draft follow-on wire fraud emails in the victim's voice within minutes.
**How found:** SOC analysts noticed hundreds of login events all routed through the same Railway PaaS infrastructure; same cloud IP hitting 50 organizations in a week signaled a coordinated campaign rather than isolated phishing.
**Exploitation:** PhaaS kit sold on Telegram (~$1,500 + $500 maintenance) with phishing pages, lures, backend token capture and relay through Railway PaaS. Device codes generated dynamically on page load to remove timing limits. Emails sent through legitimate Cisco Secure Email, Trend Micro and Mimecast infrastructure with clean URLs. Captured tokens used to read mail/calendar/docs and send convincing follow-on fraud.
**Escalation:** AI-driven recon and lure personalization, inbox/calendar/document scanning post-capture, automated follow-on wire fraud in victim's voice; relayed through trusted Railway infrastructure to evade blocklists.
**Insight:** Pivot on shared PaaS/cloud egress IPs (Railway, etc.) across many tenants' authentication logs; a single IP touching dozens of orgs in a week is a strong campaign signal even when each individual login looks legitimate and MFA-satisfied.