On September 22, 2026, Microsoft’s Digital Crimes Unit seized 50 websites and disabled more than 150 domains tied to EvilTokens, an AI-powered phishing-as-a-service platform that compromised over 12,000 inboxes across more than 10,000 organisations worldwide. Two men, aged 32 and 38, were arrested by British police earlier this month in connection with the operation. Canada was among the top six countries where victim activity was concentrated, alongside the United States, the United Kingdom, Australia, India, and France.
The lesson this story delivers is not about OAuth device code flows or token theft mechanics. It is about why the human layer of cybersecurity remains the most exploitable surface area, regardless of how many technical controls an organisation adds around it.
How EvilTokens Made Every Employee the Vulnerability
EvilTokens exploited the device code authentication flow, a mechanism designed for signing into services on devices with limited keyboards, such as smart televisions. When a victim clicked a phishing link, they were shown a legitimate Microsoft device code and directed to microsoft.com/devicelogin, a real Microsoft page. After completing their usual multi-factor authentication prompt, the attacker’s background script silently claimed the resulting session token. The employee had done nothing wrong by conventional standards: no suspicious domain, no strange request, no bad grammar.
The platform offered 44 themed email templates covering invoices, shared files, RFP documents, and HR compensation notices. AI personalised each lure to fit the target’s role, and once inside a compromised mailbox, the platform analysed email activity to identify contacts with financial authority. It then generated targeted follow-up messages requesting fraudulent wire transfers or direct-deposit changes. This is the business email compromise playbook delivered at industrial scale, available to any criminal for a $1,500 USD sign-up fee plus $500 a month.
Why Canadian Finance and HR Teams Were in the Crosshairs
EvilTokens was not a blunt-force consumer fraud tool. Its AI-assisted targeting was built for the enterprise environment: accounts payable clerks, HR administrators, and executives with payment authority. The sectors named in Microsoft’s report map directly onto the Canadian organisational landscape: financial services, construction, real estate, higher education, and healthcare. Canada’s placement among the top six victim countries reflects how heavily Canadian organisations rely on Microsoft 365, where the device code flow was enabled by default for many tenants.
In our work with Canadian finance and executive teams, we consistently see that the highest-value targets receive the least training, because nobody wants to make the CEO sit through a 20-minute module. This is exactly the gap that incidents like the one above exploit.
What Your Awareness Program Cannot Afford to Leave Out
EvilTokens was designed to defeat the training most organisations already run. The attack looked like a real Microsoft page, used a real code, and completed a real MFA challenge. The employees who authorised those sessions were not careless; they were following the patterns they had been taught. What they had not been taught is how to handle an authentication prompt they did not initiate: pause, do not enter the code, call the IT desk. That is a behaviour, not a piece of knowledge, and behaviour only changes through practice. Running phishing simulations that test real readiness means building exercises that mirror how EvilTokens actually worked, not how phishing looked five years ago.
The most immediately actionable step: verify whether your organisation’s Conditional Access policies block the device code authentication flow for users with no documented business need for it. Microsoft has made this a single-step configuration change in Entra ID, and it removes the technical precondition that EvilTokens relied on. That policy closes the technical door. Awareness training closes the human one. Both are required.
Sources
- Microsoft Security Blog: Unmasking EvilTokens: Getting to the root of device code phishing (September 22, 2026)
- The Hacker News: Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises (September 22, 2026)
- Axios: Microsoft, partners disrupt EvilTokens, AI-powered phishing service (September 22, 2026)
