Even if you enter a code on a genuine sign-in screen, your account may still be used by a third party. We will introduce the ...

Microsoft disrupted the EvilTokens phishing platform, which used AI-powered device code phishing to compromise thousands of ...

A new phishing kit abuses a legitimate Microsoft device authorization flow intended for use with printers or smart TVs to steal authentication tokens, register attacker-controlled devices and gain ...

Microsoft said Tuesday that it led an industry-wide disruption of a subscription-based scam platform that used an AI chatbot ...

EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners ...

The service, marketed through a Telegram channel, combined device-code phishing with automated analysis of stolen inboxes. Microsoft said it has now disrupted the operation, seizing 50 ...

Multiple Russian nation-state actors are targeting sensitive Microsoft 365 accounts via device code authentication phishing, a new analysis by Volexity has revealed. The firm first observed this ...

A new malicious kit called EvilTokens integrates device code phishing capabilities, allowing attackers to hijack Microsoft accounts and provide advanced features for business email compromise attacks.

An active campaign from a threat actor potentially linked to Russia is targeting Microsoft 365 accounts of individuals at organizations of interest using device code phishing. The targets are in the ...

Sentire uncovers the GhostCode phishing kit abusing Microsoft OAuth to steal tokens, register attacker devices and access ...

The security step many of us trust most may not protect us the way we think. The FBI is warning about an emerging phishing-as-a-service platform called Kali365. It targets Microsoft 365 accounts, ...