--- title: What EvilTokens teaches us about defending against... description: EvilTokens, a phishing-as-a-service platform, uses AI to analyze compromised Microsoft 365 environments and plan fraud after gaining access. It exploits OAuth... canonical: https://daily.dev/posts/what-eviltokens-teaches-us-about-defending-against-ai-assisted-attacks-wrwn2kgq3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What EvilTokens teaches us about defending against AI-assisted attacks | daily.dev og:description: EvilTokens, a phishing-as-a-service platform, uses AI to analyze compromised Microsoft 365 environments and plan fraud after gaining access. It exploits OAuth... og:url: https://daily.dev/posts/what-eviltokens-teaches-us-about-defending-against-ai-assisted-attacks-wrwn2kgq3 og:image: https://api.daily.dev/og/posts/Wrwn2kGq3.png og:image:alt: What EvilTokens teaches us about defending against AI-assisted attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What EvilTokens teaches us about defending against AI-assisted attacks **[CSO Online](https://daily.dev/sources/csoonline)** · 6 min read · 0 upvotes · 0 comments ## Summary EvilTokens, a phishing-as-a-service platform, uses AI to analyze compromised Microsoft 365 environments and plan fraud after gaining access. It exploits OAuth 2.0's device authorization grant flow to access Microsoft accounts without fake login pages. First identified in February 2026, the operation was linked to threat actor Storm-2992, which Microsoft took down in September; Microsoft said it used AI 'at every step of the attack chain.' AI identifies payment controllers, trusted relationships and fraud opportunities, then drafts convincing impersonation messages. The piece argues MTTD and MTTR metrics need reevaluation since attackers may accomplish more within the same detection window, and advocates testing security controls together across the full attack path rather than in isolation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does EvilTokens compromise Microsoft 365 accounts without a fake login page? EvilTokens exploits the device authorization grant flow of OAuth 2.0, convincing victims to authorize attacker access directly rather than stealing passwords through a fraudulent login page. Once inside, it uses AI to analyze the environment, identify who controls payments and trusted business relationships, then drafts fraudulent messages grounded in real conversations. _Security teams defending Microsoft 365 track emerging OAuth abuse techniques like this one on daily.dev._ ### Why are MTTD and MTTR no longer good enough metrics for measuring security team performance? Because AI-assisted attackers can accomplish significantly more within the same detection window than attackers previously could, a historically impressive mean-time-to-detect or mean-time-to-respond means less than it used to. Speed should be measured by how quickly a threat can reach impact, not by comparison to an organization's past performance. _Teams rethinking incident response metrics against faster AI-driven attacks follow this debate on daily.dev._ ### Who was behind the EvilTokens phishing-as-a-service operation and what happened to them? The threat actor believed to be behind EvilTokens was Storm-2992, which Microsoft took down in September. Microsoft stated the EvilTokens operation leveraged AI 'at every step of the attack chain,' using it to analyze compromised Microsoft 365 environments and recommend impersonation targets for fraud. _Developers tracking AI-powered threat actor takedowns like Storm-2992 can follow the story on daily.dev._ ## Similar posts on daily.dev - [Evil Token: AI-Enabled Device Code Phishing Campaign](https://daily.dev/posts/evil-token-ai-enabled-device-code-phishing-campaign-vbp9mzpqq) · Coralogix · 0 upvotes · 0 comments - [EvilTokens Campaign Reveals Device Code Phishing Ticks Up 1,380%, Powered by AI](https://daily.dev/posts/eviltokens-campaign-reveals-device-code-phishing-ticks-up-1-380-powered-by-ai-mreylstuo) · Security Boulevard · 0 upvotes · 0 comments - [New EvilTokens service fuels Microsoft device code phishing attacks](https://daily.dev/posts/new-eviltokens-service-fuels-microsoft-device-code-phishing-attacks-e2rcnqijq) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#microsoft](https://daily.dev/tags/microsoft), [#phishing](https://daily.dev/tags/phishing), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/what-eviltokens-teaches-us-about-defending-against-ai-assisted-attacks-wrwn2kgq3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What EvilTokens teaches us about defending against AI-assisted attacks","url":"https://daily.dev/posts/what-eviltokens-teaches-us-about-defending-against-ai-assisted-attacks-wrwn2kgq3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-eviltokens-teaches-us-about-defending-against-ai-assisted-attacks-wrwn2kgq3"},"datePublished":"2026-10-26T09:06:12.427Z","dateModified":"2026-10-26T11:14:24.041Z","description":"EvilTokens, a phishing-as-a-service platform, uses AI to analyze compromised Microsoft 365 environments and plan fraud after gaining access. It exploits OAuth...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/25705713716a4a23c4f3075a24df23de?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/25705713716a4a23c4f3075a24df23de?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-eviltokens-teaches-us-about-defending-against-ai-assisted-attacks-wrwn2kgq3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"microsoft,phishing,oauth","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"What EvilTokens teaches us about defending against AI-assisted attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-eviltokens-teaches-us-about-defending-against-ai-assisted-attacks-wrwn2kgq3#faq","mainEntity":[{"@type":"Question","name":"How does EvilTokens compromise Microsoft 365 accounts without a fake login page?","acceptedAnswer":{"@type":"Answer","text":"EvilTokens exploits the device authorization grant flow of OAuth 2.0, convincing victims to authorize attacker access directly rather than stealing passwords through a fraudulent login page. Once inside, it uses AI to analyze the environment, identify who controls payments and trusted business relationships, then drafts fraudulent messages grounded in real conversations. Security teams defending Microsoft 365 track emerging OAuth abuse techniques like this one on daily.dev."}},{"@type":"Question","name":"Why are MTTD and MTTR no longer good enough metrics for measuring security team performance?","acceptedAnswer":{"@type":"Answer","text":"Because AI-assisted attackers can accomplish significantly more within the same detection window than attackers previously could, a historically impressive mean-time-to-detect or mean-time-to-respond means less than it used to. Speed should be measured by how quickly a threat can reach impact, not by comparison to an organization's past performance. Teams rethinking incident response metrics against faster AI-driven attacks follow this debate on daily.dev."}},{"@type":"Question","name":"Who was behind the EvilTokens phishing-as-a-service operation and what happened to them?","acceptedAnswer":{"@type":"Answer","text":"The threat actor believed to be behind EvilTokens was Storm-2992, which Microsoft took down in September. Microsoft stated the EvilTokens operation leveraged AI 'at every step of the attack chain,' using it to analyze compromised Microsoft 365 environments and recommend impersonation targets for fraud. Developers tracking AI-powered threat actor takedowns like Storm-2992 can follow the story on daily.dev."}}]} ```