Phishing Without Passwords: New Scam Turns App Permissions Into Entry Points
A new phishing operation called EvilTokens has compromised more than 340 Microsoft 365 organizations across five countries just weeks after launching in February 2026, raising concerns over a new style of cyberattack that can bypass traditional security measures.
Unlike common phishing scams that steal passwords, the attack tricks users into approving access themselves. Victims received messages asking them to enter a code on Microsoft’s legitimate login page and complete their normal multi-factor authentication (MFA). Everything appeared routine, but by approving the request, users unknowingly gave attackers long-term access to emails, files, calendars, and contacts.
Cybersecurity experts say this method is especially dangerous because no password is stolen and no suspicious login is triggered. Since users complete the login process themselves, security systems often see the activity as legitimate.
Researchers warn that people have become too used to clicking “Accept” on app permissions, especially with the rise of AI tools, browser extensions, and workplace integrations. Attackers are now taking advantage of that habit.
Mitigations
- Avoid approving login or verification requests you did not personally initiate
- Carefully review any permission or “consent” screen before clicking Accept
- Be cautious of urgent messages pushing you to sign in or verify accounts quickly
- Regularly review and remove unused third-party apps connected to your account
- Only grant apps the minimum permissions needed to function
- Report suspicious login or consent requests to your IT or security team
- Organizations should regularly audit and revoke risky or unused app permissions
- Enforce stricter controls for third-party apps and AI integrations
The incident also highlights growing concerns around third-party apps and AI integrations that connect to company systems. Experts say organizations should monitor which apps employees approve, regularly review permissions, and revoke access that is no longer needed.
Security firms are now pushing companies to treat app permissions and AI connections with the same level of scrutiny as passwords and MFA protections.
Source: https://thehackernews.com/2026/05/the-new-phishing-click-how-oauth.html