Token Captured, Inbox Weaponized: Inside EvilTokens' AI-Powered BEC Operation

EvilTokens is a phishing-as-a-service platform that exploits Microsoft's Device Code authentication flow to capture OAuth tokens. Targets complete real MFA on Microsoft's own infrastructure—no fake login page, no credentials entered on an attacker-controlled site. Post-compromise, the platform's AI-powered "MailVault" client uses Meta's LLaMA model to scan compromised inboxes, extract financial intelligence, and enable send-as-target functionality. The result: the time from token capture to active BEC shrinks from hours to minutes.

In this session, we'll walk through the full EvilTokens attack chain and show how Abnormal AI detects the behavioural anomalies that expose token abuse before fraud begins.

Register today!