{"id":6647,"date":"2026-06-19T16:18:43","date_gmt":"2026-06-19T14:18:43","guid":{"rendered":"https:\/\/bezpecnevofirme.eset.com\/sk\/?p=6647"},"modified":"2026-06-19T16:20:39","modified_gmt":"2026-06-19T14:20:39","slug":"eviltokens-phishing-cez-autorizaciu-na-stranke-microsoft","status":"publish","type":"post","link":"https:\/\/bezpecnevofirme.eset.com\/sk\/cybernews\/eviltokens-phishing-cez-autorizaciu-na-stranke-microsoft\/","title":{"rendered":"EvilTokens: Phishing cez autoriz\u00e1ciu na str\u00e1nke Microsoft"},"content":{"rendered":"\n
\"BVF<\/figure>\n\n\n\n
<\/div>\n\n\n\n

Phishing zneu\u017e\u00edvaj\u00faci legit\u00edmny prihlasovac\u00ed proces Microsoftu umo\u017e\u0148uje \u00fato\u010dn\u00edkom prenikn\u00fa\u0165 do \u00fa\u010dtov bez kr\u00e1de\u017ee hesiel \u010di vytv\u00e1rania falo\u0161n\u00fdch prihlasovac\u00edch str\u00e1nok.<\/em><\/p>\n\n\n\n

Phishing zalo\u017een\u00fd na e-mailoch pln\u00fdch gramatick\u00fdch ch\u00fdb s jednoduch\u00fdm vizu\u00e1lnym spracovan\u00edm je najm\u00e4 v\u010faka umelej inteligencii na \u00fastupe. EvilTokens v\u0161ak ukazuje trochu in\u00fdm sp\u00f4sobom, ako ve\u013emi sa phishing za posledn\u00e9 roky posunul.<\/p>\n\n\n\n

EvilTokens je phishing-as-a-service (PhaaS) toolkit ur\u010den\u00fd na kompromit\u00e1ciu \u00fa\u010dtov Microsoft 365 prostredn\u00edctvom zneu\u017eitia autoriza\u010dn\u00e9ho toku OAuth 2.0<\/a> pre zariadenia, takzvan\u00e9ho device authorization grant flow<\/em>. Ke\u010f\u017ee \u00fatoky vyu\u017e\u00edvaj\u00face EvilTokens stoja na phishingu cez k\u00f3dy zariaden\u00ed (device code phishing<\/em>), \u00fato\u010dn\u00edci nepotrebuj\u00fa presved\u010div\u00e9 k\u00f3pie legit\u00edmnych prihlasovac\u00edch str\u00e1nok, na ktor\u00fdch by obete zad\u00e1vali svoje hesl\u00e1. Namiesto toho obe\u0165 prin\u00fatia dokon\u010di\u0165 legit\u00edmny proces prihl\u00e1senia \u2013 vr\u00e1tane dvojfaktorovej autentifik\u00e1cie (2FA) \u2013 na skuto\u010dnej prihlasovacej str\u00e1nke Microsoftu.<\/p>\n\n\n\n

Toolkit bol propagovan\u00fd cez kan\u00e1ly na Telegrame a v akt\u00edvnych \u00fatokoch sa objavuje minim\u00e1lne od febru\u00e1ra 2026. Ako zdokumentovali spolo\u010dnos\u0165 Sekoia a \u010fal\u0161\u00ed v\u00fdskumn\u00edci, kit si r\u00fdchlo osvojili kyberzlo\u010dinci a nasadili ho pri viacer\u00fdch \u00fatokoch zameran\u00fdch na prevzatie \u00fa\u010dtov a kompromit\u00e1ciu firemnej e-mailovej komunik\u00e1cie, zn\u00e1mu ako BEC (business email compromise<\/em>).

Patrila sem aj kampa\u0148 z marca 2026<\/a>, ktor\u00e1 cielila na viac ako 340 organiz\u00e1ci\u00ed vo viacer\u00fdch krajin\u00e1ch. Samotn\u00fd Microsoft op\u00edsal<\/a> aj phishingov\u00fa kampa\u0148 vyu\u017e\u00edvaj\u00facu k\u00f3dy zariaden\u00ed, pri ktorej \u00fato\u010dn\u00edci nasadili umel\u00fa inteligenciu, dynamick\u00e9 generovanie k\u00f3dov a cielen\u00e9 n\u00e1vnady s cie\u013eom zv\u00fd\u0161i\u0165 \u00faspe\u0161nos\u0165 \u00fatokov EvilTokens.<\/p>\n\n\n\n

Ako funguje EvilTokens phishing<\/h2>\n\n\n\n

Tu je stru\u010dn\u00fd preh\u013ead toho, ako prebiehaj\u00fa \u00fatoky vyu\u017e\u00edvaj\u00face EvilTokens:<\/p>\n\n\n\n

    \n
  1. \u00datoku predch\u00e1dza prieskum.<\/strong>
    \u00dato\u010dn\u00edci si najsk\u00f4r overia, \u010di je cie\u013eov\u00fd \u00fa\u010det akt\u00edvny. Microsoft zaznamenal, \u017ee tento prieskum prebiehal 10 a\u017e 15 dn\u00ed pred samotn\u00fdm phishingov\u00fdm pokusom.<\/li>\n\n\n\n
  2. Obe\u0165 dostane e-mail alebo spr\u00e1vu s n\u00e1vnadou.<\/strong>
    T\u00e1 \u010dasto p\u00f4sob\u00ed ako fakt\u00fara, zdie\u013ean\u00fd dokument, pozv\u00e1nka do kalend\u00e1ra alebo \u017eiados\u0165 o pr\u00edstup k SharePointu. S\u00fa\u010das\u0165ou n\u00e1vnady b\u00fdva podvodn\u00e1 str\u00e1nka napodob\u0148uj\u00faca d\u00f4veryhodn\u00fa zna\u010dku a jednoduch\u00fd text typu \u201eOverte sa pre zobrazenie\u201c alebo \u201eVy\u017eaduje sa podpis\u201c.<\/li>\n\n\n\n
  3. Po kliknut\u00ed str\u00e1nka po\u017eiada Microsoft o k\u00f3d.<\/strong>
    Tento k\u00f3d je platn\u00fd len 15 min\u00fat, preto je pri \u00fatoku d\u00f4le\u017eit\u00e9 na\u010dasovanie.<\/li>\n\n\n\n
  4. Obe\u0165 zad\u00e1 k\u00f3d na skuto\u010dnej str\u00e1nke Microsoftu.<\/strong>
    Podvodn\u00e1 str\u00e1nka obeti zobraz\u00ed k\u00f3d a nasmeruje ju na legit\u00edmny prihlasovac\u00ed port\u00e1l Microsoftu na adrese microsoft.com\/devicelogin. H\u00e1\u010dik je v tom, \u017ee k\u00f3d patr\u00ed rel\u00e1cii \u00fato\u010dn\u00edka. Obe\u0165 tak nevedomky autorizuje zariadenie \u00fato\u010dn\u00edka, nie svoje vlastn\u00e9.<\/li>\n\n\n\n
  5. Microsoft vyd\u00e1 pr\u00edstupov\u00e9 tokeny \u00fato\u010dn\u00edkovej rel\u00e1cii.<\/strong>
    Ke\u010f\u017ee z poh\u013eadu Microsoftu ide o platn\u00e9 prihl\u00e1senie, \u00fato\u010dn\u00edk z\u00edska pr\u00edstupov\u00e9 a obnovovacie tokeny. Po preniknut\u00ed do \u00fa\u010dtu m\u00f4\u017eu zlo\u010dinci pristupova\u0165 k firemn\u00fdm e-mailom, s\u00faborom, Teams, SharePointu, OneDrivu a \u010fal\u0161\u00edm zdrojom v Microsoft 365. N\u00e1sledne m\u00f4\u017eu exfiltrova\u0165 d\u00e1ta alebo pripravova\u0165 BEC \u00fatoky. Pr\u00e1ve preto s\u00fa pre nich obzvl\u00e1\u0161\u0165 zauj\u00edmav\u00e9 \u00fa\u010dty z oddelen\u00ed financi\u00ed, HR, logistiky a predaja.<\/li>\n<\/ol>\n\n\n\n
    <\/div>\n\n\n
    \n
    \n

    Zosta\u0148te v obraze
    a o krok pred \u00fato\u010dn\u00edkmi.<\/h3>\n

    Prihl\u00e1ste sa na odber n\u00e1\u0161ho newslettra a ka\u017ed\u00fd mesiac z\u00edskajte preh\u013ead o aktu\u00e1lnych hrozb\u00e1ch aj praktick\u00e9 rady, ako chr\u00e1ni\u0165 firmu.<\/h4>\n<\/p><\/div>\n