Hackers Found a Way to Bypass Your Two-Factor Authentication — Here's Exactly How

In February 2026, a hacking tool called EvilTokens went live as a phishing-as-a-service platform. Within just five weeks it had compromised more than 340 Microsoft 365 organisations across five countries — without stealing a single password or triggering a single suspicious login alert.

The attack exploits something you do every day without thinking — clicking "Allow" when an app asks permission to access your Google or Microsoft account. This permission is called an OAuth consent grant. When a victim clicks Allow on a fake consent screen, the attacker doesn't receive a password. They receive something far more dangerous: a refresh token. This is essentially a master key to your account that works completely independently of your password, survives password resets, and remains valid for weeks or even months depending on your account settings.

What makes this attack so dangerous from an information security standpoint is that it operates in a blind spot. Traditional cybersecurity tools are built to detect stolen passwords and suspicious login attempts from unfamiliar locations. They don't monitor consent grants because those are supposed to be legitimate user actions. More critically, two-factor authentication cannot block it because the victim has already completed their MFA challenge before the token is issued. The system isn't being hacked — it's working exactly as designed.

This attack affects anyone who uses Gmail, Google Drive, Microsoft Outlook, or has ever clicked "Login with Google" or "Login with Facebook" on any app or website. For Indian users specifically, the consequences extend far beyond one compromised account. If your Gmail is taken over through this method, attackers gain access to the password reset emails for your WhatsApp, net banking portal, UPI-linked services, and every other app you've registered with that email address — effectively handing them the keys to your entire digital life.

The danger multiplies significantly through what security researchers call toxic combinations. Most people have granted multiple apps access to different parts of their account over time — one AI tool reads your calendar, another accesses your Google Drive, a third connects to your inbox. Each grant was approved individually and seemed harmless on its own. But once an attacker holds a token from any one of those grants, they can reach everything else through the connections you've already approved yourself. This is not theoretical. In 2025, a single compromised connector spread through more than 700 Salesforce accounts through exactly this mechanism.

It's also critical to understand that changing your password after being compromised does not fix this. The refresh token the attacker holds was issued and signed by the real Google or Microsoft server. It remains valid until someone explicitly revokes it — which most users have no idea they need to do.