Device Code Phishing After EvilTokens

Six weeks after Microsoft took down EvilTokens, a detection I’d written for it started firing again. Further investigation led me to a device code phishing platform that appears to serve several customers from one shared backend – one that might predate the takedown.