Listen to this Post
Introduction: When a Legitimate Email Becomes the Weapon
Cyberattacks are becoming harder to recognize because attackers no longer need to make their messages look obviously malicious. Instead, they are increasingly hiding behind services people already trust.
That is exactly what makes the latest campaign tracked as Doubloon Dredger so concerning. According to research attributed to Sublime’s Threat Intelligence & Research team, financially motivated attackers have been abusing free Notion accounts, legitimate Notion infrastructure, malicious PDF documents, executive impersonation and Microsoft device-code authentication to steal authentication tokens from targeted organizations.
The campaign represents a dangerous evolution in phishing. The victim may receive an email that appears to come from a familiar executive, see a genuine Notion notification, click through a legitimate-looking document and ultimately authenticate through Microsoft’s real infrastructure.
Nothing about the final login page necessarily screams “fake.”
That is the problem.
The attack is not simply about stealing a password. It is about convincing the victim to authorize an attacker’s device and then allowing the attacker to walk away with authentication tokens that can potentially provide access to corporate resources.
Security researchers have already documented EvilTokens as a Phishing-as-a-Service platform built around Microsoft’s OAuth 2.0 device authorization flow. Sekoia reported that the kit began appearing in the wild around February 2026 and was rapidly adopted by cybercriminals conducting account takeover and business email compromise operations.
The Bigger Picture: Phishing Has Become an Authentication Problem
Traditional phishing generally follows a familiar formula: send a fake login page, steal the username and password, defeat or intercept MFA and then access the account.
Device-code phishing changes the equation.
Instead of asking victims to surrender their passwords, attackers can persuade them to complete a legitimate authentication process using an attacker-generated device code.
That distinction is crucial.
Research from the Cloud Security Alliance explains that the technique does not necessarily “break” MFA in the traditional sense. Instead, it redirects what the authentication process ultimately authorizes. The victim can successfully authenticate against Microsoft’s genuine infrastructure while the resulting authorization is delivered to an attacker-controlled session.
This means a user can technically do everything they have been trained to do—check the domain, complete MFA and follow Microsoft’s instructions—and still compromise the organization.
Doubloon Dredger Exploits Trust Before Technology
The campaign attributed to Doubloon Dredger reportedly begins with an especially clever social-engineering technique.
Attackers create accounts that impersonate senior executives and use those accounts to trigger document-sharing notifications through Notion.
The email tells the recipient that an executive has shared a document with them.
That scenario is completely ordinary inside many companies.
Employees receive document-sharing invitations every day. Managers share reports. Finance teams exchange spreadsheets. Executives distribute presentations. Legal departments collaborate on contracts.
The attacker is therefore not trying to create an unusual event.
They are trying to create a believable one.
Why Notion Makes the Phishing Email More Convincing
The most important part of the campaign is that the attackers reportedly abused legitimate Notion infrastructure.
Because the notification originates through legitimate Notion systems, the email can pass standard email authentication mechanisms such as SPF, DKIM and DMARC.
That creates a dangerous gap between technical email validation and actual security.
A security system may effectively determine:
“Yes, this message really came through Notion’s authorized infrastructure.”
But that does not answer the more important question:
“Was the Notion account itself being used maliciously?”
This distinction is becoming increasingly important across cloud services.
An authenticated message is not automatically a trustworthy message.
The PDF Is the Bridge to the Real Attack
After the victim clicks the Notion notification, the campaign reportedly sends them to an intermediary PDF.
The PDF is designed to resemble a legitimate business document and contains a prominent “Review and Sign” button.
This is another layer of psychological manipulation.
The victim is not initially being asked to “log in.”
They are being asked to review or sign a document.
The authentication step comes later.
That separation can make the attack feel less suspicious because every stage appears to have a reasonable business purpose.
EvilTokens Turns Authentication Into the Trap
The critical moment occurs when the victim clicks the button inside the PDF.
Instead of opening a genuine Adobe document-sharing workflow, the victim is redirected to an EvilTokens-powered phishing page designed to resemble an Adobe Acrobat authentication experience.
The page generates a device verification code and instructs the victim to use Microsoft’s legitimate device-code authentication mechanism.
This is where the attack becomes particularly deceptive.
The victim may actually visit
The domain can be correct.
The certificate can be correct.
The authentication process can be real.
The MFA process can be real.
Yet the authorization can still benefit the attacker.
EvilTokens has been documented as a PhaaS platform that specifically abuses the Microsoft device authorization flow and provides capabilities for account takeover and post-compromise operations.
The Token Is More Valuable Than the Password
Once the victim enters the
This is why the campaign should not be dismissed as ordinary credential phishing.
A password reset alone may not be sufficient after token theft.
Organizations must also investigate and revoke active sessions and tokens, examine OAuth activity and determine what resources were accessed after the authorization event.
Security teams should think beyond:
Was the password stolen?
The better question is:
What authentication artifacts did the attacker obtain?
MailVault Makes Compromised Mailboxes More Dangerous
The reported EvilTokens infrastructure also includes MailVault, a webmail-style interface that allows attackers to interact with compromised mailboxes.
That capability dramatically increases the potential impact.
Once attackers gain access to a corporate inbox, they can search for invoices, contracts, passwords, financial discussions, authentication links, employee information and confidential documents.
They can also potentially monitor conversations before launching the next stage of the attack.
This transforms account compromise into an intelligence-gathering operation.
Business Email Compromise Becomes the Next Step
A compromised executive or finance employee account can be worth far more than the initial credentials.
Attackers can study existing conversations and imitate the victim’s communication style.
They can identify suppliers.
They can locate payment discussions.
They can discover upcoming transactions.
They can monitor internal conversations.
They can wait for the right moment.
Then they can send a convincing message from an account that employees already trust.
This is why modern phishing campaigns increasingly blur the boundary between credential theft and business email compromise.
Sekoia has previously documented EvilTokens capabilities designed to support BEC workflows, including email harvesting, reconnaissance and token weaponization.
The PDF Infrastructure Contains Another Layer of Deception
Sublime reportedly identified 14 additional PDFs containing matching metadata and overlapping-link construction.
The PDFs reportedly contained two or three links positioned over the same visible button.
That is a fascinating technical detail because different PDF readers may interpret overlapping objects differently.
For defenders, that creates uncertainty.
For attackers, it can provide redundancy.
The exact reason for the construction remains uncertain, and Sublime reportedly assessed the infrastructure explanation with low confidence.
Nevertheless, it demonstrates how seemingly simple phishing documents can contain multiple layers designed to complicate automated analysis.
Different Victims, Different Industries
The reported samples targeted organizations across several industries, including manufacturing, telecommunications, retail, healthcare and logistics.
That diversity is important.
This is not an attack dependent on one specialized sector.
Every organization has employees who receive documents.
Every organization has Microsoft identities.
Every organization has executives whose names can be impersonated.
Every organization has employees who may trust collaboration notifications.
The attack therefore has a broad potential victim pool.
EvilTokens Is Not Operating Alone
Some samples reportedly redirected victims toward Kratos phishing pages instead of EvilTokens.
Researchers also found similarities between JavaScript used in the campaign and activity associated with Tycoon2FA, another device-code phishing operation.
The analysis reportedly identified 603 related scripts, with 416 decoding to EvilTokens infrastructure and 187 associated with Tycoon2FA.
Sublime assessed with moderate confidence that Doubloon Dredger was a customer of both PhaaS platforms.
This is significant because it reinforces the idea that modern cybercrime increasingly resembles a service economy.
Attackers do not necessarily need to build every component themselves.
They can rent infrastructure.
They can purchase phishing kits.
They can buy access.
They can reuse document generators.
They can outsource token harvesting.
They can even use separate providers for different stages of the attack.
The PhaaS Economy Is Changing the Threat Landscape
EvilTokens is particularly important because it demonstrates how sophisticated authentication attacks can be packaged for criminals who do not possess advanced development skills.
Sekoia described EvilTokens as a turnkey Microsoft device-code phishing kit and reported that it was distributed through Telegram-based criminal communities.
Other research has shown that the platform has evolved beyond simple phishing pages into a broader account-compromise ecosystem.
Cisco Talos, for example, reported in July 2026 that infrastructure associated with an EvilTokens-related operation included capabilities for token management, mailbox access, email sending, inbox-rule manipulation and BEC activity.
The lesson is straightforward.
The phishing page is only the front door.
Why Traditional MFA Training Is No Longer Enough
For years, organizations taught employees:
Never enter your password into suspicious websites.
That advice remains valid.
But it is no longer sufficient.
Employees must now understand that legitimate authentication pages can also be part of an attack.
A user can be sent to the correct Microsoft domain and still be interacting with an attacker-controlled authentication transaction.
This is one of the most uncomfortable developments in identity security.
The security boundary has moved from the login page to the authorization decision.
The Device-Code Problem
Device-code authentication was designed for legitimate scenarios where one device cannot conveniently display or complete an authentication workflow.
The mechanism is useful.
The problem is that attackers can manipulate the context surrounding it.
The victim may receive instructions such as:
“To access this document, enter the following code.”
The victim then goes to
From the
From the
Attackers Are Learning to Hide in Legitimate Cloud Services
This campaign also reflects a much broader security trend.
Attackers increasingly prefer legitimate cloud platforms over obviously malicious infrastructure.
They can abuse collaboration platforms.
They can abuse cloud storage.
They can abuse document-sharing services.
They can abuse identity providers.
They can use reputable CDNs.
They can compromise legitimate accounts.
The result is a form of camouflage.
Instead of asking defenders to identify malicious infrastructure, attackers force defenders to determine whether legitimate infrastructure is being abused.
That is a much harder problem.
The AI Factor Makes This Trend More Dangerous
The broader 2026 phishing landscape is also being shaped by AI-assisted automation.
Security research has documented increasingly personalized phishing lures, automated BEC workflows and PhaaS platforms that reduce the amount of manual work required by criminals. Sekoia has specifically reported AI-assisted capabilities in EvilTokens for analyzing harvested emails and supporting BEC operations.
This matters because personalization historically required skilled operators.
Now, software can help automate it.
An attacker can potentially move from mass phishing toward highly contextualized messages without manually researching every victim.
That is a dangerous shift.
Deep Analysis: How Defenders Should Break the Attack Chain
1. Disable Device-Code Authentication Where It Is Not Required
Organizations should evaluate whether Microsoft device-code authentication is genuinely necessary.
If it is not required, administrators should disable or restrict it.
The exact implementation depends on the
2. Audit Device-Code Authentication Events
Security teams should search Entra ID sign-in and audit logs for device-code authentication and investigate unusual events.
A useful starting point for Microsoft Graph PowerShell administrators is:
Connect-MgGraph -Scopes "AuditLog.Read.All"
Get-MgAuditLogSignIn -All |
Where-Object {
$_.AuthenticationProtocol -match "device"
} |
Select-Object CreatedDateTime,
UserPrincipalName,
AppDisplayName,
IpAddress,
ResourceDisplayName,
AuthenticationProtocol
The exact available properties can vary with Microsoft Graph API versions and tenant configuration, so defenders should validate the fields against their current environment.
3. Search for Suspicious OAuth Activity
Look for unusual applications, authorization events, unfamiliar client applications and unexpected consent activity.
For example:
Get-MgAuditLogDirectoryAudit -All |
Where-Object {
$_.ActivityDisplayName -match "consent|permission|application"
} |
Select-Object ActivityDateTime,
ActivityDisplayName,
InitiatedBy,
TargetResources
The goal is not simply to identify failed logins.
The goal is to understand whether a user successfully authorized something they did not intend to authorize.
4. Investigate Token Abuse After Authentication
If a device-code phishing event is confirmed, investigate what happened afterward.
Look for:
Successful authentication
↓
Device-code authorization
↓
New session/token activity
↓
Mailbox access
↓
Graph/SharePoint activity
↓
Inbox-rule changes
↓
Suspicious outbound email
This timeline can reveal whether the incident was limited to token acquisition or developed into full account compromise.
5. Inspect Inbox Rules
Attackers who gain mailbox access may create rules that hide incoming security notifications or forward valuable messages.
Defenders can inspect mailbox rules with Exchange Online PowerShell:
Get-EXOMailbox -ResultSize Unlimited |
ForEach-Object {
Get-InboxRule -Mailbox $_.PrimarySmtpAddress |
Select-Object MailboxOwnerId,
Name,
Enabled,
ForwardTo,
RedirectTo,
DeleteMessage,
MoveToFolder
}
Focus particularly on unexpected forwarding, deletion or movement of messages.
6. Search for Suspicious Outbound Messages
Compromised accounts frequently become launchpads for additional phishing.
Security teams should search for:
Messages sent immediately after unusual authentication
Messages sent to external recipients
New messages containing document-sharing lures
Messages impersonating executives
Unexpected replies to financial conversations
Unusual attachment or URL patterns
A compromised mailbox can become the second-generation delivery mechanism.
7. Revoke Sessions After Confirmed Token Theft
If an attacker has successfully obtained tokens, changing the password is not necessarily enough.
Incident responders should follow the
The objective is to terminate the
8. Monitor Notion and Other Collaboration Platforms
Email security cannot be the only layer.
Organizations should also monitor legitimate collaboration platforms for:
Unexpected external sharing
New accounts impersonating executives
Suspicious document invitations
Abnormal workspace activity
Unusual sharing domains
Unexpected document notifications
Cloud collaboration services are increasingly becoming part of the phishing delivery chain.
9. Train Users to Question Device Codes
Security awareness programs should explicitly teach one rule:
Never enter a device code because an email, document or chat message tells you to do so unless the authentication request was independently verified.
That message is far more relevant to
- Treat MFA Success as a Security Signal, Not a Verdict
A successful MFA event does not automatically mean an account is safe.
It means authentication succeeded.
Security teams still need to ask:
What application was authorized?
What device initiated the request?
What resource was accessed?
Was the authorization expected?
That shift in thinking is essential for defending against token-based phishing.
What Undercode Say:
The most disturbing aspect of Doubloon Dredger is not the PDF.
It is not even Notion.
The real danger is the
A legitimate email service becomes the delivery mechanism.
A legitimate collaboration platform becomes the credibility layer.
A PDF becomes the psychological bridge.
A legitimate Microsoft login page becomes the authentication endpoint.
MFA becomes part of the attack rather than a barrier against it.
OAuth becomes the mechanism for delivering the stolen authorization.
And a compromised mailbox becomes the
That is an entirely different phishing model from the one many organizations are still training employees to recognize.
The old phishing model depended heavily on deception at the login page.
The new model can depend on deception before the login page.
That distinction changes everything.
A security team may inspect the final URL and see Microsoft’s real domain.
A secure email gateway may validate the original Notion notification.
An employee may confirm that the message looks professionally written.
The victim may successfully complete MFA.
Every individual checkpoint can appear normal.
The attack succeeds because the entire chain is malicious even though individual components are legitimate.
This is why identity security increasingly needs to be contextual.
Authentication should not be evaluated in isolation.
Authorization should not be evaluated in isolation.
Cloud application activity should not be evaluated in isolation.
Email security should not be evaluated in isolation.
The organization needs to connect the events.
That is where modern detection platforms become increasingly important.
The Notion component also highlights another major problem: trusted infrastructure is becoming a commodity for attackers.
If criminals can create accounts on legitimate platforms, they gain access to infrastructure that already has reputation.
That makes domain-based blocking less effective.
It also creates a difficult question for defenders: how do you block abuse without blocking the legitimate platform?
The answer cannot simply be block Notion.
That would create enormous operational damage while failing to solve the underlying identity problem.
Instead, organizations need behavioral detection.
Who sent the document?
Was that account recently created?
Was the account previously associated with the company?
Does the executive actually use that collaboration service?
Was the document shared with an unusual group of employees?
Did the message arrive immediately before a suspicious authentication event?
Did the user subsequently perform device-code authentication?
Those correlations can expose attacks that individual security products miss.
The PDF construction is another warning sign.
A document with multiple overlapping links may look like a minor technical curiosity.
It is not.
It demonstrates that attackers are thinking about how different security tools interpret the same artifact.
One PDF reader may see one destination.
Another may interpret another object.
An automated scanner may process the file differently from a human.
That creates an opportunity for detection gaps.
The increasing use of PhaaS makes this even more concerning.
Doubloon Dredger does not necessarily need to understand every component of the infrastructure.
If a criminal marketplace provides the device-code phishing platform, the attacker can concentrate on targeting victims.
That lowers the technical barrier to sophisticated attacks.
The same pattern has appeared throughout cybercrime.
Ransomware became more scalable through Ransomware-as-a-Service.
Credential theft became scalable through infostealer ecosystems.
Now advanced identity attacks are becoming scalable through Phishing-as-a-Service.
This is industrialization.
And industrialization means defenders should expect volume.
The resurgence of Tycoon2FA after disruption also demonstrates that takedowns alone are unlikely to solve the problem.
Infrastructure can disappear.
Operators can rebuild.
Code can be copied.
Affiliates can migrate.
New platforms can emerge.
The underlying technique remains.
That means the defensive focus must shift toward reducing the value of the technique.
If device-code authentication is unnecessary, remove it.
If it is necessary, restrict it.
If suspicious OAuth authorization occurs, detect it.
If a token is compromised, revoke it.
If an inbox is compromised, investigate its history.
If a malicious application is authorized, remove it.
The most effective defense is therefore not a single product.
It is a chain of controls designed to break the attack chain at multiple points.
The campaign also provides a lesson for executives.
Executive impersonation remains powerful because employees are trained to respond quickly to senior leadership.
That urgency can be weaponized.
Executives should therefore be treated as high-value identities requiring stronger monitoring, not simply stronger passwords.
Finally, the biggest lesson is uncomfortable but necessary:
A legitimate authentication page can be part of an illegitimate attack.
That concept needs to become part of every modern security-awareness program.
The browser can show the correct Microsoft domain.
The user can complete MFA correctly.
The email can pass SPF, DKIM and DMARC.
And the organization can still be compromised.
That is the reality of device-code phishing in 2026.
✅ EvilTokens Is a Real Device-Code Phishing Threat
EvilTokens has been independently documented by multiple security researchers as a Phishing-as-a-Service platform abusing Microsoft’s OAuth device authorization flow. Sekoia reported the kit in March 2026 after observing it in active campaigns.
✅ MFA Can Be Circumvented Without Breaking MFA
The description is technically accurate in an important sense: attackers do not necessarily defeat the MFA mechanism itself. Instead, they manipulate the authorization context so that the victim’s legitimate authentication helps authorize an attacker-controlled session.
✅ EvilTokens Supports Post-Compromise Activity
Independent research has documented capabilities beyond initial token theft, including email harvesting, Microsoft Graph reconnaissance, token weaponization and BEC-oriented functionality.
✅ Device-Code Phishing Has Become a Broader 2026 Trend
The campaign should not be viewed as an isolated technique. Multiple security organizations have documented a significant increase in device-code phishing during 2026, alongside the growth of PhaaS and increasingly automated phishing infrastructure.
⚠️ Some Doubloon Dredger Details Remain Attribution Assessments
The specific attribution to Doubloon Dredger, the precise relationship between the PDF builder and other actors, and the assessment that the actor was a customer of both EvilTokens and Tycoon2FA should be treated as research assessments rather than independently proven facts.
The original reporting itself assigns different confidence levels to parts of the attribution, so those details should not be presented as absolute certainty.
⚠️ Passing SPF, DKIM and DMARC Does Not Mean the Email Is Safe
This is an important clarification rather than a contradiction. Email authentication validates aspects of message origin and delivery authorization; it does not prove that the sending account or platform was used legitimately.
An attacker abusing an authenticated cloud account can therefore produce a message that passes technical email-authentication checks while remaining malicious.
Prediction
(+1) Device-Code Phishing Will Become a Standard Enterprise Attack Technique
The combination of legitimate authentication, PhaaS automation and token-based compromise makes device-code phishing attractive to financially motivated criminals.
As awareness improves around traditional credential phishing, attackers are likely to invest even more heavily in authorization abuse because it can bypass many of the visual warning signs employees have learned to recognize.
Organizations that restrict unnecessary device-code authentication and build stronger OAuth monitoring into their identity defenses will be significantly better positioned to resist these campaigns.
(-1) Trust in Cloud Collaboration Notifications Will Continue to Decline
As attackers increasingly abuse legitimate collaboration services, employees may become less willing to trust document-sharing notifications from platforms such as Notion, Microsoft 365 and other cloud services.
That creates a difficult security trade-off.
Companies need collaboration tools to move quickly, but every trusted notification channel can become a potential social-engineering pathway.
The likely result is a future where organizations rely less on the appearance of a notification and more on identity-aware authorization, behavioral analytics and out-of-band verification.
Final Analysis: The New Phishing Battlefield Is Authorization
Doubloon Dredger’s reported campaign is a powerful example of where enterprise phishing is heading.
The attacker does not need to create a perfect fake Microsoft website.
They do not necessarily need the victim’s password.
They do not necessarily need to defeat MFA.
Instead, they manipulate trust until the victim performs a legitimate authentication action on the attacker’s behalf.
That is why device-code phishing deserves immediate attention from security teams.
The most important defensive question is no longer simply:
“Did the user log in?”
It is:
“What did the user authorize?”
For organizations operating Microsoft 365 environments, that distinction could determine whether a suspicious document-sharing email remains an attempted phishing attack—or becomes the first step toward a full corporate account takeover.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
