Even if you enter a code on a genuine sign-in screen, your account may still be used by a third party. We will introduce the ...

Microsoft disrupted the EvilTokens phishing platform, which used AI-powered device code phishing to compromise thousands of ...

A new phishing kit abuses a legitimate Microsoft device authorization flow intended for use with printers or smart TVs to steal authentication tokens, register attacker-controlled devices and gain ...

EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners ...

Multiple Russian nation-state actors are targeting sensitive Microsoft 365 accounts via device code authentication phishing, a new analysis by Volexity has revealed. The firm first observed this ...

Cybercriminals and state-sponsored hackers are increasingly exploiting Microsoft’s legitimate OAuth 2.0 device authorization process to hijack enterprise accounts, bypassing multifactor authentication ...

Microsoft said Tuesday that it led an industry-wide disruption of a subscription-based scam platform that used an AI chatbot ...

An active campaign from a threat actor potentially linked to Russia is targeting Microsoft 365 accounts of individuals at organizations of interest using device code phishing. The targets are in the ...

The service, marketed through a Telegram channel, combined device-code phishing with automated analysis of stolen inboxes. Microsoft said it has now disrupted the operation, seizing 50 ...

A new malicious kit called EvilTokens integrates device code phishing capabilities, allowing attackers to hijack Microsoft accounts and provide advanced features for business email compromise attacks.

The security step many of us trust most may not protect us the way we think. The FBI is warning about an emerging phishing-as-a-service platform called Kali365. It targets Microsoft 365 accounts, ...