#ParsedReport #CompletenessMedium
22-09-2026

Unmasking EvilTokens: Getting to the root of device code phishing

https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/

Report completeness: Medium

Actors/Campaigns:
Storm-2992 (motivation: cyber_criminal)

Threats:
Device_code_phishing_technique
Eviltokens_tool
Aitm_technique
Bec_technique
Spear-phishing_technique

Victims:
Wholesale distribution, Construction, Financial services, Real estate, Higher education, Healthcare

Industry:
Education, Healthcare

Geo:
France, United kingdom, Australia, United states, India, Canada

TTPs:
Tactics: 4
Technics: 0

Soft:
Microsoft Defender, Microsoft Defender for Endpoint, Node.js, Telegram, Office 365, vercel, Microsoft Office, Microsoft Entra, Graph API

Functions:
checkStatus

Languages:
php

Platforms:
cross-platform