EvilTokens PhaaS: OAuth Device Code Flow Bypass – Detection and Defense

---
title: Potential OAuth Device Code Flow Login
id: 8f4c1b2e-5a6d-4b3c-9e1f-2a3b4c5d6e7f
status: experimental
description: Detects sign-ins where the authentication method is Device Code Flow, which is uncommon for standard user workstations and may indicate a phishing attempt like EvilTokens.
references:
  - https://attack.mitre.org/techniques/T1528/
  - https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.credential_access
  - attack.t1528
logsource:
  product: azure
  service: signin_logs
detection:
  selection:
    AuthenticationDetails|contains: 'Device Code Flow'
  filter_legit_iot:
    DeviceDetail|contains: 'IoT' # Optional filter if environment uses IoT
  condition: selection | not filter_legit_iot
falsepositives:
  - Legitimate use of IoT devices or CLI tools (e.g., Azure CLI) requiring device code
level: high
---
title: EvilTokens - Consent to Application via Device Flow
id: a9e2d3c4-5f6a-4b7c-8d1e-2a3b4c5d6e7f
status: experimental
description: Detects when a user consents to an application, specifically looking for patterns associated with the EvilTokens PhaaS or high-risk permissions granted immediately after a device code interaction.
references:
  - https://thehackernews.com/2026/05/the-new-phishing-click-how-oauth.html
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.initial_access
  - attack.t1078.004
logsource:
  product: azure
  service: audit_logs
detection:
  selection_consent:
    OperationName|startswith:
      - 'Consent to application'
      - 'Add OAuth2PermissionGrant'
  selection_risky_app:
    TargetResourceDisplayName|contains:
      - 'EvilTokens'
      - 'Microsoft365'
      - 'M365 Support'
  condition: all of selection_*
falsepositives:
  - Legitimate application registration by administrators
level: critical

// Hunt for Device Code Flow Sign-ins
SigninLogs
| where AuthenticationDetails contains "Device Code Flow"
| extend AppId = AppId, DeviceDetail = DeviceDetail
| project TimeGenerated, UserPrincipalName, AppId, StatusCode, ConditionalAccessStatus, AuthenticationDetails, DeviceDetail
| sort by TimeGenerated desc

// Correlate with Risky App Consents
let RiskyApps = dynamic(["EvilTokens", "M365 Support", "Office365 Verify"]);
AuditLogs
| where OperationName in ("Consent to application", "Add OAuth2PermissionGrant", "Add appRoleAssignmentToPrincipal")
| where TargetResources[0].DisplayName has_any (RiskyApps)
| project TimeGenerated, Caller, OperationName, TargetResources, InitiatedBy
| sort by TimeGenerated desc

-- Hunt for browser history artifacts indicating interaction with microsoft.com/devicelogin
-- Note: Requires access to browser history files (Chrome/Edge)

SELECT * FROM foreach(
    glob(globs='*/History', root=OSPath("/Users/*/Library/Application Support/Google/Chrome/Default")), 
    x => parse_csv(filename=x.file, accessor='sqlite', query='SELECT url, last_visit_time, title FROM urls WHERE url LIKE "%microsoft.com/devicelogin%"')
)
WHERE url =~ 'microsoft.com/devicelogin'

# Requires Microsoft Graph PowerShell Module
# Connect-MgGraph -Scopes "Application.Read.All", "AppRoleAssignment.ReadWrite.All", "Policy.ReadWrite.ConditionalAccess"

# Function to identify and report ServicePrincipals matching EvilTokens patterns
function Find-EvilTokensServicePrincipals {
    param(
        [string[]]$SuspiciousKeywords = @("EvilTokens", "M365 Support", "DeviceLogin", "OauthVerify")
    )

    $apps = Get-MgServicePrincipal -All
    $rogueApps = $apps | Where-Object { 
        $keywords = $SuspiciousKeywords -join "|"
        $_.DisplayName -match $keywords -or $_.AppId -match $keywords
    }

    if ($rogueApps) {
        Write-Host "[ALERT] Found potentially malicious service principals:" -ForegroundColor Red
        $rogueApps | Select-Object Id, DisplayName, AppId, PublisherName
        return $rogueApps
    } else {
        Write-Host "[INFO] No obviously malicious service principals found based on keywords." -ForegroundColor Green
    }
}

# Function to remove App Role Assignments (Consent) for a specific App ID
function Revoke-EvilTokensPermissions {
    param(
        [string]$AppId
    )

    $sp = Get-MgServicePrincipal -Filter "AppId eq '$AppId'"
    if (-not $sp) {
        Write-Host "[ERROR] Service Principal with AppId $AppId not found." -ForegroundColor Red
        return
    }

    $assignments = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id
    if ($assignments) {
        Write-Host "[ACTION] Removing $($assignments.Count) assignments for app $($sp.DisplayName)..." -ForegroundColor Yellow
        foreach ($assignment in $assignments) {
            Remove-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -AppRoleAssignmentId $assignment.Id
            Write-Host "[SUCCESS] Revoked assignment for user $($assignment.PrincipalId)" -ForegroundColor Green
        }
    }
}

# Execute Detection
Find-EvilTokensServicePrincipals