CTI · reviewed · 2026-09-29

EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts

Full story & timeline

Actors

Storm-2992

Malware / tools

EvilTokens

Campaigns

—

CVEs

—

Victim sectors

cross-sector

Geography

United StatesCanadaUnited KingdomAustraliaIndiaFrance

MITRE ATT&CK

T1566 Phishing Initial Access
T1621 Multi-Factor Authentication Request Generation Credential Access
T1528 Steal Application Access Token Credential Access
T1098 Account Manipulation Persistence
T1114 Email Collection Collection
T1657 Financial Theft Impact

Indicators

Observables tied to this case, from the curated feed. raw sidecar

index-ap3.tyler2miler-proton-me-s-account.workers.dev domain · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: EvilTokens PhaaS Landing Page Device Code Endpoints
id: 3c7d5b91-8e24-4f6a-a0d3-5b19c7e2f840
status: experimental
description: "Detects HTTP requests to EvilTokens phishing landing pages: the kit's own REST endpoints (/api/device/start issues the Microsoft device code, /api/prt/convert and /api/prt/cookie mint the x-ms-RefreshTokenCredential cookie) or Cloudflare Workers hostnames following the docusign-/onedrive- prefix with a -s-account suffix used for campaign tracking. Complements the inbox-rule persistence detection by catching the capture side at the proxy or web gateway."
references:
  - https://www.sekoia.com/blog/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1
  - https://newtonpaul.com/blog/device-code-phishing-campaign/
  - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-03-23-%20Device-Code-based-OAuth-Phishing.txt
author: Tia N. List
date: 2026/09/29
tags:
  - attack.t1566
  - attack.initial-access
  - attack.t1621
  - attack.credential-access
logsource:
  category: webserver
detection:
  selection_api:
    cs-uri|contains:
      - '/api/device/start'
      - '/api/prt/convert'
      - '/api/prt/cookie'
  selection_workers:
    cs-uri|contains: '-s-account.workers.dev'
  condition: selection_api or selection_workers
falsepositives:
  - Security researchers or sandboxed URLs fetched by analysts
  - Malicious-link detonation by secure email gateways (the lures routinely pass such gateways unflagged)
level: high

YARA-X raw

rule EvilTokens_Phishing_Kit_Pages {
    meta:
        author = "Tia N. List"
        date = "2026-09-29"
        status = "experimental"
        description = "EvilTokens (Storm-2992) device-code phishing landing pages: the kit's REST endpoints, the anti-bot header it injects, the Microsoft refresh-token cookie it mints, and the Cloudflare Workers tracking-host naming scheme. Derived from case analysis (Sekoia, Unit 42, Microsoft) — NOT validated against a live sample."
        reference = "https://www.sekoia.com/blog/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1"
        falsepositives = "Analyst sandbox detonation of captured lures; pages served through security-product URL rewriting"
    strings:
        $api_start = "/api/device/start" ascii nocase
        $api_prt_convert = "/api/prt/convert" ascii nocase
        $api_prt_cookie = "/api/prt/cookie" ascii nocase
        $hdr_antibot = "X-Antibot-Token" ascii nocase
        $cookie_prt = "x-ms-RefreshTokenCredential" ascii nocase
        $workers_pattern = "-s-account.workers.dev" ascii nocase
    condition:
        3 of them
}