New EvilTokens service fuels Microsoft device code phishing attacks

Wednesday, April 1, 2026 at 07:42 PM UTC·Source: BleepingComputer

Updated: Thursday, April 2, 2026 at 04:49 PM UTC

Executive Summary

A new malicious kit called EvilTokens integrates device code phishing capabilities, allowing attackers to hijack Microsoft accounts and provide advanced features for business email compromise attacks. [...]

Analysis

Source Attribution

Originally published by BleepingComputer on Apr 1, 2026.

Related Threats

CRITICALPhishing

Yokogawa CENTUM VP

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-092-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker to login as the PROG user and modify permissions.</strong></p> <p>The following versions of Yokogawa CENTUM VP are affected:</p> <ul> <li>CENTUM VP >=R5.01.00|</li>

CVE-2025-7741

17h agoCISA Advisories

CRITICALPhishing

PX4 Autopilot

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker with access to the MAVLink interface to execute arbitrary shell commands without cryptographic authentication.</strong></p> <p>The following versions of PX4 Autopil

CVE-2026-1579

2d agoCISA Advisories

MEDIUMPhishing

Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels

Cybersecurity researchers have discovered a remote access toolkit of Russian-origin that's distributed via malicious Windows shortcut (LNK) files that are disguised as private key folders. The CTRL toolkit, according to Censys, is custom-built using .NET and includes various executables" to facilitate credential phishing, keylogging, Remote Desktop Protocol (RDP) hijacking, and reverse tunneling

3d agoThe Hacker News