Microsoft Device Code Phishing - EvilTokens Kit Discovered
Basically, a new phishing tool tricks people into giving away their Microsoft account access.
A global phishing campaign is exploiting Microsoft's device code system using the EvilTokens kit. Organizations are at risk of losing sensitive data as attackers gain access to accounts. Vigilance and security measures are crucial to thwart these threats.
What Happened
A global phishing campaign has emerged, targeting Microsoft accounts through a new kit known as EvilTokens. This sophisticated attack has affected organizations across various countries, including the U.S., Canada, France, Australia, India, Switzerland, and the UAE. The attackers use deceptive emails that appear to contain legitimate financial documents, luring victims into clicking links that lead to fake login pages.
How It Works
The EvilTokens phishing kit operates by sending emails that contain links to spoofed websites. These sites mimic trusted services and display a verification code. Victims are prompted to click a "Continue to Microsoft" button, which redirects them to a legitimate Microsoft login page. Here, they are tricked into entering a device code, which grants attackers access to temporary access tokens and refresh tokens.
Who's Being Targeted
The primary targets of this phishing scheme are organizations and individuals who use Microsoft accounts. The attackers have shown a particular interest in businesses, as the kit also facilitates business email compromise (BEC) attacks. This makes it critical for companies to be aware of the risks associated with such phishing attempts.
Signs of Infection
Victims may notice unusual activity in their Microsoft accounts following a successful phishing attempt. This includes unauthorized access to emails, files, and Microsoft Teams information. If users receive unexpected emails requesting verification or login details, they should be cautious.
How to Protect Yourself
To safeguard against these phishing attacks, users should:
- Verify email sources before clicking on links or downloading attachments.
- Enable multi-factor authentication (MFA) on their Microsoft accounts to add an extra layer of security.
- Educate employees about recognizing phishing attempts and the importance of reporting suspicious emails.
- Regularly monitor account activity for any unauthorized access.
What to Watch
As the EvilTokens kit gains traction, it is likely that more phishing campaigns will emerge, utilizing similar tactics. Organizations should stay informed about evolving phishing techniques and continuously update their security measures. Additionally, keeping an eye on threat intelligence reports can help in identifying new threats early on.