AI-Augmented EvilTokens Phishing Campaign Compromises Hundreds Daily
An AI-augmented phishing service called EvilTokens has been used in a widespread campaign since March 2026 to compromise Microsoft accounts at hundreds of organizations daily. The tool exploits device code authentication vulnerabilities and uses AI to create personalized messages, with attackers focusing on finance-related roles and data extraction.
What happened
A large-scale phishing campaign active since March 15, 2026 has compromised hundreds of organizations daily through attacks on Microsoft accounts. The campaign involves 10 to 15 separate campaigns every 24 hours, each targeting hundreds of organizations with unique payloads.
The attacks use an AI-driven phishing kit called EvilTokens, available as a service since mid-February, which bypasses multi-factor authentication and silently accesses Microsoft 365 accounts. Attackers exploit a device code authentication vulnerability, sending phishing messages containing authentication codes to trick users into granting access.
Reported impact
Organizations worldwide across multiple sectors have been impacted with no confirmed attribution. Post-compromise activity shows attackers focusing on finance-related roles and using automation to extract emails from affected accounts.
Index analysis
EvilTokens uses AI to create highly personalized phishing messages based on target roles, often including themes such as invoices, proposals, and operational workflows. The tool's developers are planning to extend support to Gmail and Okta environments beyond Microsoft accounts.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.