EvilTokens: techroboticslabmade.com — OAuth Device Code PhaaS Bypasses MFA Across 340+ Orgs

The primary EvilTokens MailVault C2 domain techroboticslabmade.com resolves to Cloudflare anycast IPs 104.21.29.34 and 172.67.171.74. The domain returns HTTP 403 on all probed paths — root, /api/device/start, /api/device/status/, /health, /robots.txt, /login. This is Cloudflare gating the backend, not a takedown: the nameservers are ELLE.NS.CLOUDFLARE.COM and NICOLAS.NS.CLOUDFLARE.COM, indicating the operator actively manages DNS through Cloudflare.

CertSpotter reveals a wildcard certificate (*.techroboticslabmade.com) issued 2026-06-02 — four months after campaign launch, three months after the March 2 campaign acceleration. This renewal signals active operational maintenance of the platform, not abandonment. The domain was registered 2025-07-14 via Cloudflare, Inc. as registrar — 7 months of pre-campaign infrastructure preparation.

Reverse IP lookup against 216.126.227.101 (the RouterHosting/Cloudzy backend previously identified as the macmamo.com PHP host) returns two domains: macmamo.com and notificationsmanagersec.com. The second domain is not present in any published EvilTokens threat report reviewed during this investigation.

notificationsmanagersec.com was registered 2026-03-10 via NameSilo — exactly 8 days after the March 2 campaign acceleration identified by Huntress. Registration during active campaign expansion, on the same C2 backend, with a name pattern matching operator alert infrastructure ("notifications manager security") is strong co-location evidence. No MX record and no SPF record — Telegram exfiltration model, consistent with all other EvilTokens infrastructure. The domain returns HTTP 000 on all paths, indicating the Cloudzy backend is selectively offline or port-filtered.

EvilTokens does not harvest credentials. It hijacks the OAuth Device Authorization Grant (RFC 8628), a flow designed for input-limited devices like smart TVs. The attacker initiates a device code request, presents the victim with a real Microsoft URL and a legitimate-looking code, waits for the victim to authenticate normally (MFA included), and captures the resulting refresh token. The victim's login succeeds — no error, no redirect warning. The token is what the attacker needs.

Token replay occurs twice daily from Railway.com infrastructure — observed at 11:00 AM and 8:00 PM — granting persistent access to the compromised mailbox, OneDrive, calendar, and contacts for up to 90 days per token without any further victim interaction.

The token replay infrastructure runs entirely on Railway.com PaaS, exploiting the platform's clean IP reputation to pass Microsoft's risk scoring. Five Railway IPs account for the vast majority of observed token authentication polling. Three of those five — 162.220.234.41 (254 events), 162.220.234.66 (132 events), and 162.220.232.57 (97 events) — account for approximately 84% of all observed events. This concentration indicates a centralized backend rather than distributed ephemeral deployment.

The Railway CIDR blocks are registered under RLWY-METALGEN1-01 (ARIN handle). Two CIDR blocks cover the entire EvilTokens relay footprint: 162.220.232.0/22 and 162.220.234.0/22. Blocking these at the Entra ID Conditional Access layer eliminates the persistent replay mechanism even when the refresh token itself is active. Additional secondary CIDRs observed in lower-volume events: 152.55.176.0/20, 208.77.244.0/22, 66.33.22.0/23, 69.46.46.0/24, 69.9.164.0/22, IPv6 2607:99c0::/32.

EvilTokens exhibits three unique detection signals that allow SIEM-level hunting in Entra ID sign-in logs without requiring network-level visibility:

1. BAV2ROPC user-agent: The automated token polling script uses the user-agent string BAV2ROPC. This is not a legitimate browser UA. It appears in Microsoft's Unified Audit Log under UserAgent for the token replay events. Any occurrence of BAV2ROPC in M365 sign-in logs is indicative of automated credential or token stuffing.

2. Synthetic mobile UA: To evade risk-based conditional access scoring, the kit inserts a fake iPhone UA: Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.3 Mobile/15E148 Safari/604.1. The Version/26.3 field did not exist in early 2026 — iOS Safari uses Version/17 or Version/18. This fabricated string is a reliable SIEM signature.

3. Non-standard HTTP header: EvilTokens landing pages served through Railway.com include X-Antibot-Token as a non-standard response header. This is the platform's bot detection mechanism and functions as a fingerprint — any page serving this header in an M365 authentication context is EvilTokens infrastructure.

4. Entra ID session flag: Successful device code phishing events appear in sign-in logs with cmsi session designation — observed in 87.4% of confirmed EvilTokens compromise events.

EvilTokens compromised organizations across 7 countries: United States, Canada, France, Australia, India, Switzerland, and the UAE. France and Germany are confirmed EU victim countries. The platform launched on the NOIRLEGACY GROUP Telegram channel on February 16, 2026, offering three operator products: "B2B Sender" (outbound BEC mail via compromised accounts), "Office 365 Capture Link" (device code landing page kit), and "SMTP Sender" (bulk mail relay via captured credentials).

Post-compromise monetization uses a LLaMA-based inbox summarization module that reads the victim's email, extracts open invoices, wire transfer instructions, vendor relationships, and financial patterns — then drafts BEC emails that pass SPF/DKIM/DMARC because they originate from the compromised account itself. The sectors most impacted: construction, real estate, financial services, legal services, and healthcare — all high-value BEC targets with frequent wire transfers.

EU regulatory exposure: email access without authorization is a GDPR Art. 32 breach (inadequate security of personal data). Each compromised EU mailbox containing employee or client personal data is a reportable incident under Art. 33 (72-hour notification). Affected French organizations must notify CNIL. German organizations notify BSI and relevant Landesbehörden.