Content by microsoft threat intelligence, microsoft defender experts and microsoft security research (1)

Microsoft Threat Intelligence, Microsoft Defender Experts and Microsoft Security Research break down EvilTokens, a phishing-as-a-service platform that abuses the OAuth device code flow to steal tokens and take over accounts. The post explains the attack chain, common evasion techniques, and concrete Defender/Entra mitigations plus hunting queries.