EvilTokens emerges as a new PHaaS Microsoft takeover platform
The core of EvilTokens is the abuse of Microsoft’s OAuth 2.0 Device Authorisation Grant, a legitimate flow designed for devices with limited input capabilities such as smart TVs or printers.
Normally, a device displays a short code that the user enters on a separate browser to authenticate. EvilTokens hijacks this flow by acting as the authenticating device and tricking victims into completing the sign-in on the attacker’s behalf.
The attack begins when the attacker sends a request to Microsoft’s API to generate a fresh device code.
This code is passed to the victim through a phishing page or attachment. The victim, believing they are simply verifying access to a shared document or invoice, visits the real Microsoft login page and enters the code.
Once they complete the sign-in, the attacker’s system receives a valid access token and a refresh token, granting immediate and long-lasting access to the account.
Again, the human remains the weakest link, and employees need training to understand that entering a device code can actually authorise an attack!
PLEASE contact your First Technology account manager to connect you with our training specialists to help ensure everybody is kept up to date on how to handle these increasingly sophisticated attacks.
| 
