Deception is moving at machine speed. Learn to keep pace.
Portal LoginSupportBlogContact
Search
Portal LoginSupportBlogContact
Search
Get a Demo
Start for Free
HomeResources
EvilTokens and the Rise of AI-Powered Phishing
Report
Jun 23, 2026

EvilTokens and the Rise of AI-Powered Phishing

Download Your Report
By submitting this form, you accept our Terms of Service & Privacy Policy

Phishing just got a serious upgrade, and the old defenses aren’t built for it.

In early 2026, Huntress spotted a campaign called EvilTokens. It’s a Phishing-as-a-Service (PhaaS) platform with AI baked in, built to steal Microsoft 365 tokens at scale. There’s no malware or fake login pages. Just real Microsoft authentication flows, turned against the people using them.

Device code phishing attacks spiked 1,380% between July–December 2025 and January–April 2026. Across 344 victim organizations in a single wave, no two phishing lures were identical. That’s how attackers put AI to work, personalizing attacks fast enough to outpace filters and stay ahead of traditional defenses.

This report goes deeper into what Huntress found, what it means for the future of cybersecurity, and what you can do about it.

Evil Tokens Report

What’s inside the report

  • How device code phishing actually works. Spoiler alert: It abuses a legit Microsoft authentication flow, which makes it nearly impossible to spot using traditional defenses.
  • The AI components pushing scale. From personalized lures to automated inbox analysis that identifies wire transfer threads, AI is doing the heavy lifting for attackers.
  • The Railway and BL Networks playbooks. A breakdown of the specific infrastructure these attacks ran on, the event data behind them, and how Huntress disrupted the first wave.
  • A victim’s POV. A scenario showing exactly how a normal workday unravels when a real Microsoft sign-in is the start of a full-blown identity attack.
  • The defender’s checklist. Recommendations from Huntress and Microsoft security experts on immediate actions and longer-term hardening steps, including Conditional Access policies, token revocation, and what to watch for after a login.

What this means for defenders

Identity is where this fight is happening now. When attackers abuse real authentication flows, the tells shift from the email layer to the identity layer: who logged in, from where, and what changed after access was granted.

Related Resources

  • Read more about Inside the Breaches: Lessons from M&S, Co-Op & Harrods’ Cyber Intrusions
    Inside the Breaches: Lessons from M&S, Co-Op & Harrods’ Cyber Intrusions
    On-Demand Virtual Event

    Inside the Breaches: Lessons from M&S, Co-Op & Harrods’ Cyber Intrusions

    In April 2025, UK retailers M&S, Co-op, and Harrods suffered major cyberattacks that exposed gaps in supply chain security, credential protection, and threat response. Join Huntress investigators as they break down how these breaches unfolded, why they were effective, and what security teams can learn. This session will blend technical analysis with actionable guidance to help you strengthen defences, improve detection, and prepare for evolving threats.

  • Read more about Unfriendly Followers: The Black Market For Your Identity
    Unfriendly Followers: The Black Market For Your Identity
    On-Demand Virtual Event

    Unfriendly Followers: The Black Market For Your Identity

    Learn how scattered public data turns into cyber threats. Watch Huntress Truman Kain and Cybersecurity Girl Caitlin Sarian break down identity risks.

  • Read more about EvilTokens: Big Cybercrime’s AI Platform Built to Bypass Your MFA
    EvilTokens: Big Cybercrime’s AI Platform Built to Bypass Your MFA
    On-Demand Virtual Event

    EvilTokens: Big Cybercrime’s AI Platform Built to Bypass Your MFA

    Watch a candid discussion about where this threat is headed and why this campaign may mark a watershed moment in cybercrime.

  • Read more about The Huntress Tragic Quadrant
    The Huntress Tragic Quadrant
    Report

    The Huntress Tragic Quadrant

    Which cyber tactics are wrecking businesses? The Huntress Tragic Quadrant ranks today’s top attacker techniques by impact and shows how to stop them.

  • Read more about Your Hidden Competition: Inside the Business of Modern Cybercrime
    Your Hidden Competition: Inside the Business of Modern Cybercrime
    On-Demand Virtual Event

    Your Hidden Competition: Inside the Business of Modern Cybercrime

    Modern cybercrime groups run like standard enterprises. Watch real attack demos with John Hammond and Jim Browning to learn how attackers operate and outsmart them.

  • Read more about Known Gaps, Open Doors
    Known Gaps, Open Doors
    Report

    Known Gaps, Open Doors

    This report, based on research from 521 security and IT professionals, examines why endpoint and identity security keeps breaking down, and why the answer isn't to add more self-managed point solutions.

  • Read more about The AI-Powered Adversary
    The AI-Powered Adversary
    Ebook

    The AI-Powered Adversary

    Learn how today’s AI-powered adversary weaponizes phishing and social engineering with real incidents Huntress has investigated. Get the download.

  • Read more about The New Rules of Attacking Education in 2026
    The New Rules of Attacking Education in 2026
    Report

    The New Rules of Attacking Education in 2026

    How are cyber attacks on schools and universities changing in 2026? See the threat patterns, real examples, and resilience strategies in the Huntress education report.

  • Read more about What is Device Code Phishing?
    What is Device Code Phishing?
    Video

    What is Device Code Phishing?

    Device code phishing doesn’t hack its way in. It uses a legitimate authentication flow to walk right through the front door, with no password required, MFA bypassed, and session tokens handed straight to the attacker.

Frequently asked questions

Security teams, IT leaders, and partners managing Microsoft 365 environments, especially those who want to understand where phishing is headed and how to get ahead of it.

Yes. Download the full report above.

Telemetry from the Huntress Security Operations Center (SOC), drawn from real incidents observed across Huntress-protected organizations in early 2026, including detailed analysis of the Railway and BL Networks attack waves.