A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages

https://www.welivesecurity.com/en/cybercrime/eviltokens-phishing-doesnt-steal-password/
https://www.welivesecurity.com/en/cybercrime/eviltokens-phishing-doesnt-steal-password/

A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages
Mon, 15 Jun 2026 08:55:00 +0000
https://web-assets.esetstatic.com/wls/2026/06-26/eviltokens-device-token-theft.jpg
Cybercrime

Source: WeLive Direct Feed
Source Link: https://www.welivesecurity.com/en/cybercrime/eviltokens-phishing-doesnt-steal-password/