EvilTokens phishing kit

A document leads to Microsoft's device sign-in

Microsoft describes EvilTokens as a phishing-as-a-service operation that appeared in February 2026. Its operators offered document-themed pages that affiliates could run on Cloudflare Workers, Bunny infrastructure or PHP hosting.

The visitor sees a shared document and a prompt to verify access. The page requests a short Microsoft user code from the kit's server, displays it with a copy button and opens Microsoft's device sign-in page. While the visitor enters the code and signs in, the lure polls its own session endpoint every three seconds. A completed session replaces the lure with a success message and sends the visitor to an ordinary document service.

Microsoft says EvilTokens campaigns used dozens of lure themes. Our retained copies moved from a OneDrive memo to an Adobe Acrobat Sign update and then a DocuSign proposal during September. The presentation changed; the session requests, device-code handoff and polling loop stayed consistent.

The visible page is decrypted in the browser

The outer EvilTokens document is a compact loader. It Base64-decodes an encrypted payload and its key material, asks the browser's Web Crypto API to decrypt the payload with AES-GCM, then replaces the original document with the resulting HTML. It appends a second script that blocks the context menu, common developer-tool shortcuts and simple debugger checks.

Other EvilTokens entry pages in our records add two gates before the device-code screen. One collects an email address from a document prompt, includes a hidden company field to catch automated submissions and passes the email to another local path. Another presents an arithmetic question and validates the answer on the server.

What we see

Month	New sites
September	15
October so far	1

The latest EvilTokens match in this snapshot was 12 October. 3 sites matched in the last 30 days.

Checking a site for EvilTokens

Inspect the exact link and its network requests with safe test data. Look for:

• a document page that collects an email before moving to another local path
• a POST to /captcha/verify with hidden expected and return_path fields
• crypto.subtle.decrypt using AES-GCM, followed by document.open(), document.write() and document.close()
• a session initialization response containing a Microsoft user code
• a three-second status poll while a Microsoft device sign-in window is open

Remove the lure, encrypted loader and supporting server routes. Review who changed the site's files and deployment settings, revoke the affected Microsoft sessions and rotate the hosting credentials.