EvilTokens: A phishing attack that doesn’t steal your password

EvilTokens is a phishing kit that subverts Microsoft’s legitimate authentication flow to achieve account takeover without stealing passwords or using fake login pages. Instead of harvesting credentials, the kit abuses the token/authorization flow (OAuth/OIDC/SSO-style interactions) to obtain or replay authentication artifacts and gain access to accounts, potentially bypassing conventional password-based defenses and some non-phishable controls. This technique raises significant risk to user accounts and organizations relying on standard federated sign‑on unless phishing‑resistant MFA, OAuth/re