Device-code phishing can use a real sign-in page for a false request
Understand the EvilTokens report, check who initiated the device sign-in and revoke suspicious sessions and tokens after exposure.
In brief
Microsoft’s EvilTokens analysis describes abuse of device-code authentication. The victim can sign in on a genuine provider page while approving a code belonging to an attacker’s request.
The key question is whether you initiated the device connection and recognize the application requesting access, not only whether the login domain is real.
Check the origin of the code
A smart device or supported application can legitimately display a device code. An unexpected message asking you to enter one to view a file is a different context. Stop and verify the requesting service independently rather than following the sender’s reassurance.
Read what you are authorizing
Check the named application and requested access. If you did not start that app’s connection, do not approve. Never send the code or a sign-in confirmation to an unsolicited helper who claims it is only a verification step.
Remove the resulting access
Use the provider’s compromised-account route and inspect authorized apps and active sessions. Microsoft’s report notes that access can persist when associated tokens and sessions remain valid. Follow the account’s actual revocation controls; changing a password alone is not a complete guarantee.
Before you act
Legitimate device-code flows exist. Do not approve a code from an unsolicited document or caller merely because the authentication page looks official.
What to do next
- Only begin a device sign-in from a connection you intentionally started.
- Read the requesting app and permissions before approving a code.
- If you approved a suspicious flow, use official account recovery to review grants, sessions and tokens, involving IT for managed accounts.
