The Hacker News article highlights an important shift in phishing: attackers are no longer always trying to steal passwords. They are increasingly trying to trick users into approving OAuth consent, which can give attackers long-lived access tokens to mailboxes, files, calendars, contacts, and other SaaS data, even when MFA is enabled. In the reported EvilTokens campaign, users were pushed through legitimate Microsoft authentication and MFA, but the real compromise happened when access was granted through OAuth consent.

This is a dangerous blind spot because many organizations still treat MFA as the final security boundary. MFA protects the login, but it does not automatically protect what users approve after login. Once an OAuth token is issued, password resets may not be enough; organizations need explicit token revocation, grant review, conditional access around consent, and continuous visibility into third-party applications connected to user accounts. Naturally, because clicking “Allow” has become the new corporate reflex, attackers are simply moving to the place where users are least suspicious. 

For businesses, the lesson is clear: identity security must go beyond passwords and MFA. Security teams should maintain an inventory of OAuth applications, review risky permissions, restrict user consent where possible, monitor abnormal SaaS access, and revoke unused or suspicious grants. In today’s environment, a single careless consent click can be as damaging as a stolen password, only quieter and more persistent, because apparently attackers read the fine print better than most users do.

In February 2026, a phishing-as-a-service (PhaaS) platform called EvilTokens went live. Within five weeks, it had compromised more than 340 Microsoft 365 organizations across five countries. The targets of the platform received a message asking them to enter a short code at microsoft.com/devicelogin and complete their normal MFA challenge, then walked away believing they had verified a

Source: The New Phishing Click: How OAuth Consent Bypasses MFA via The Hacker News — published 19 May 2026.