EvilTokens

EvilTokens was a device code phishing toolkit that appeared in February 2026. It rapidly become one of the most prevalent phishing services and was consistently one of the top 5 phishing kits detected by Push Security from March through June 2026.

Its success may have stemmed from the relatively untapped potential of device code phishing prior to its emergence. A device code phishing attack does not require the victim to enter their password on a malicious domain and recipients may have had less familiarity with this type of attack (employees are trained that phishing asks for passwords). In fact, the victim interacts with the legitimate Microsoft OAuth identity provider during the attack.

Microsoft announced the disruption of EvilTokens in September 2026.

The face of device code phishing

Following the launch of EvilTokens in February 2026, there was a surge in device code phishing attacks. Many other device code phishing kits sprang up, and device code phishing lures were also incorporated into existing PhaaS solutions. In multiple cases, the lure templates were directly copied from the EvilTokens kit.

3 Mar 2026

EvilTokens

18 Mar 2026

LINKID

24 Mar 2026

ARToken

2 Apr 2026

VENOM

URL patterns

The large majority of EvilTokens phishing pages are reached on Cloudflare Workers domains. Two primary subdomain structures have been observed:

1. [lure-token]-[3-char].[email]-s-account.workers.dev where lure token was a string such as index, docusign, voicemail, sharepoint, etc.
2. [4-char]-[4-char]-[4-char].[email]-s-account.workers.dev

Network traffic

Upon reaching the EvilTokens landing page, a background request is made for a new device code authentication session to be started.

POST /api/device/start HTTP/1.1
Host: j80y-4lzt-hxcg.shevy-jassir-dropons-com-s-account.workers.dev
X-Antibot-Token: 1dad3cd63b87fa99eca7111280593e79945c02a1c4f554b2551d0a89320473da
Content-Length: 0

HTTP/1.1 200 OK
{"sessionId":"dev_1771696357459_4gal01vnh",
 "userCode":"E7HJFHDVZ",
 "verificationUri":"https://login.microsoft.com/device",
 "expiresIn":900}

The custom X-Antibot-Token header and HTML comments referencing "anti-bot" behaviours was behind Push Security's internal naming of "ANTIBOT" when we first started tracking this threat in late February 2026.

By mid-2026 this endpoint had been changed to POST /api/session/init.

After displaying the device authentication code to the victim, the page then polls a status endpoint to determine if authentication has occurred:

GET /api/device/status/<id> HTTP/1.1

{"status":"pending"}  →  {"status":"completed"}

This endpoint was later changed to /api/session/status/<id>.