@securityonline.bsky.socialMicrosoft dismantled the EvilTokens phishing platform, an AI-powered service that hijacked 12,000+ mailboxes via OAuth Device Code Flow abuse.
#EvilTokens #Microsoft #PhaaS #DeviceCodePhishing #Storm2992 #OAuth #CyberSecurity
@hendryadrian.bsky.socialMicrosoft and partners disrupted EvilTokens, a phishing-as-a-service platform that compromised over 12,000 Microsoft accounts at 10,000+ organizations using device-code phishing and AI tools to bypass MFA. #EvilTokens #Microsoft #Storm2992
@threadlinqs.bsky.socialAI wrote the phishing lures. A real Microsoft login page did the rest. MFA never stood a chance. https://intel.threadlinqs.com/threat/TL-2026-2614 #ThreatIntel #Storm #EvilTokens #Storm2992
