If you have ever waited for a login code that never showed up, you already know the pain. You type in your password. Microsoft asks for a code. Then you stare at your ...

EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners ...

The Tycoon2FA phishing kit now supports device-code phishing attacks and abuses Trustifi click-tracking URLs to hijack Microsoft 365 accounts. Despite an international law enforcement operation ...

CERT-In has issued a high-severity advisory on CVE-2026-70125, a flaw in Microsoft Outlook that lets remote attackers run arbitrary code through a crafted file or email. Users of Microsoft 365 Apps ...

Multiple Russian nation-state actors are targeting sensitive Microsoft 365 accounts via device code authentication phishing, a new analysis by Volexity has revealed. The firm first observed this ...

Microsoft disrupted EvilTokens after it was linked to more than 12,000 compromised inboxes across over 10,000 organizations.

Security researchers report a notable increase in device code phishing activity aimed at Microsoft 365 users, and have attributed this rise to the availability of EvilTokens, a new, specialized ...

Microsoft said Tuesday that it led an industry-wide disruption of a subscription-based scam platform that used an AI chatbot ...

Microsoft’s Digital Crimes Unit has dismantled EvilTokens, a phishing-as-a-service platform blamed for hijacking more than 12 ...

Cybercriminals are abusing Microsoft's Trusted Signing platform to code-sign malware executables with short-lived three-day certificates. Threat actors have long sought after code-signing certificates ...

A word on this week"A short code entered into a real login screen""Stolen IDs and passwords""Account funds moving without your knowledge"What the three news stories introduced this time have in common ...