AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Last Update: 10/23/2026 at 11:00 AM EST
Phishing Kits Hijack Microsoft 365 Tokens
Coverage from BleepingComputer, Security Affairs, and others
Cybercriminals are increasingly using device-code phishing, malicious OAuth applications, and adversary-in-the-middle techniques to obtain valid Microsoft 365 authentication tokens without directly stealing passwords or MFA codes.
Platforms including Tycoon2FA, ARToken, Forg365, and Kali365 package these methods into phishing-as-a-service offerings that support campaign delivery, token management, mailbox monitoring, and access to Microsoft cloud data. The activity matters because completed legitimate authentication can give attackers persistent access to Outlook, Teams, OneDrive, SharePoint, and connected single sign-on services.
Looking Back
216 Day Timeline
Feb 19
Mar 26
Apr 30
Jun 4
Jul 9
Aug 13
Sep 17
All Articles10 articles
Important
eSentire reported Tycoon2FA device-code phishing campaigns using Trustifi tracking URLs to compromise Microsoft 365 accounts via OAuth device login.
5/17/2026 • Cybersecurity (Privacy-Relevant) • General
Microsoft disclosed mid-April 2026 code-of-conduct phishing that captured authentication tokens from over 35,000 users in 26 countries, with most victims in the United States.
5/5/2026 • Cybersecurity (Privacy-Relevant) • General
ZeroBEC reports Forg365 and ForgCookie phishing techniques that steal OAuth tokens and refresh Microsoft SSO cookies to sustain Microsoft 365 account takeovers.
7/9/2026 • Cybersecurity (Privacy-Relevant) • General
Cisco Talos reported ARToken, a device-code phishing service using Microsoft 365 token theft and Primary Refresh Tokens to sustain mailbox and cloud file access.
7/3/2026 • Cybersecurity Tech (Privacy-Relevant) • General
The FBI warned about Kali365, a Telegram-based phishing-as-a-service used to steal OAuth tokens and compromise Microsoft 365 accounts.
5/22/2026 • Cybersecurity (Privacy-Relevant) • General
Government and public sector users targeted by phishing campaigns using oauth redirects to attacker controlled infrastructure recently to access data.
3/3/2026 • Personal Data & Identity • General
Interesting
Microsoft and partners disrupted EvilTokens in 2020s operations affecting thousands of enterprise accounts worldwide, while U.K. police arrested two suspected administrators in London.
9/22/2026 • Cybersecurity (Privacy-Relevant) • General
Sekoia reports EvilTokens device code phishing abuses OAuth 2.0 to steal Microsoft access and refresh tokens, enabling business email compromise across multiple countries.
3/31/2026 • Cybersecurity (Privacy-Relevant) • General
Threat actors used device-code phishing and vishing in 2020s campaigns to abuse Microsoft OAuth device authorization and access Microsoft Entra accounts across corporate environments.
2/19/2026 • Cybersecurity (Privacy-Relevant) • General
Push Security and Sekoia reported increased device code phishing in 2024, where OAuth 2.0 Device Authorization Grant abuse leads to account takeover via approved tokens.
4/3/2026 • Cybersecurity (Privacy-Relevant) • General