Cybersecurity researchers have disclosed a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies, which is used as a proxy to redirect Microsoft 365…
DOUBLOON DREDGER is a financially motivated threat actor that abuses Notion accounts to invite targets to view PDFs containing malicious links. The…
Device code phishing, which abuses the OAuth 2.0 device authorization grant to steal access tokens, has rapidly evolved from a niche technique…
A new phishing-as-a-service (PhaaS) operation called Forg365 is targeting Microsoft 365 accounts using device code phishing, adversary-in-the-middle (AitM) tactics, antibot evasion, AI-assisted…
A recent EvilTokens campaign is exploiting a new 'ghost phishing' technique that hides malicious content until it decrypts inside the victim's browser,…
EvilTokens is an attack group conducting ghost phishing campaigns targeting US and European businesses. They use Microsoft Device Code Phishing and AES-GCM…
A sophisticated device code phishing campaign targeting Microsoft 365 accounts has been observed between late June and early July 2026, leveraging collaboration-themed…
EvilTokens is a phishing kit that steals Microsoft 365 tokens through the OAuth device code flow. It also provides AI-powered analytics services…
Flare is a cybersecurity company that provides threat intelligence and digital risk monitoring. Flare security researcher Assaf Morag commented on EvilTokens, noting…