Unverified50% confidenceEventExact time
The EvilTokens phishing service compromised approximately 12,000 mailboxes without stealing any passwords.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/1/2026
First Seen
Valid until: 12/30/2026
Sources
Related Entities
Related Claims
UnverifiedEvilTokens exploited the OAuth Device Code Flow for its attacks, rather than password leaks or brute force.61% similarUnverifiedThe Google Hacking Database is still maintained by the Offensive Security community and contains thousands of verified Dork statements.59% similarUnverifiedJadePuffer ultimately encrypted 1,342 service configuration files, deleted the original files, and left a table named README_RANSOM in the database with a Bitcoin payment address.58% similarUnverifiedCredential stuffing attacks refer to attackers automatically attempting to use username-password combinations leaked from one breach to log in to other websites in order to take over accounts.58% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/965350API
curl https://kongchang.com/api/v1/knowledge/claims/965350MCP
get_claim(id=965350)