← Back to Feed
EvilTokens: A phishing attack that doesn’t steal your password
June 15, 2026 · WeLiveSecurity · Severity: LOW
A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing.
Key Takeaways
- EvilTokens is a phishing kit that subverts Microsoft's legitimate authentication flow.
- The attack lets attackers break into accounts without stealing the password.
- The phishing attack doesn't steal passwords but still compromises accounts.