TokenLover and YaksaLover: The PhaaS Kits That Measure…

Italy's ACN details two Phishing-as-a-Service toolkits that abuse the Device Code Flow and NGC keys to achieve persistence that survives password resets, complete with SaaS dashboards, subscription tiers, and an LLM pipeline for automated BEC.

Italy's National Cybersecurity Agency (ACN) has published a technical advisory on two Phishing-as-a-Service toolkits — TokenLover (formerly known as TokenVault // 2026) and YaksaLover (aliases Yakhub or Yaksha) — that automate Business Email Compromise campaigns against Microsoft 365 environments. Built as multi-tenant SaaS platforms, they lower the barrier for criminal operators by providing management dashboards, campaign monitoring, and metrics on compromised accounts across differentiated subscription tiers. The detail that makes this advisory significant beyond the headlines: an indicator called "password change survival rate", which measures how long illicit access persists after a credential reset.

Key Takeaways

TokenLover and YaksaLover are distinct PhaaS toolkits, structured as multi-tenant SaaS with dashboards, metrics, and subscription tiers to automate BEC campaigns against Microsoft 365
Initial access relies on abusing the OAuth Device Code Flow: the victim enters an attacker-controlled code on a legitimate Microsoft page, bypassing MFA without any plaintext password theft
Acquired OAuth tokens grant access to Exchange Online, Microsoft Graph, and SharePoint; persistence is cemented by registering NGC keys (Windows Hello for Business) that survive a simple password change
TokenLover integrates an LLM pipeline for automated email analysis: extraction of banking coordinates, identification of transaction approvers, modeling of corporate communication styles, and injection into live conversations

How Access Works: Abusing the Device Code Flow

The Device Code Flow is a standard OAuth mechanism designed for devices with limited input: the victim receives a code and enters it at https://microsoft.com/devicelogin to authorize a session. The ACN advisory documents that the described toolkits overlay a phishing page onto this flow, tricking the user into completing the authorization. The resulting session is fully authenticated, MFA included, because the victim themselves authorizes it.

According to the source, "the presence of multi-factor authentication does not prevent the attack if it is the victim who authorizes the session associated with the device code." The outcome is the acquisition of valid OAuth tokens for the full session lifetime, not theft of plaintext credentials. Those tokens enable access to Exchange Online, Microsoft Graph, SharePoint, and services tied to the compromised identity.

Persistence That Survives a Reset: NGC Keys and Windows Hello

The advisory describes a second capability that turns token theft into long-term compromise: registration of NGC keys (Next Generation Credentials, a component of Windows Hello for Business) on the compromised account. The attacker associates a new authentication method or controlled device with the tenant.

This mechanism has a clear operational consequence. Per the cited document, "a simple password change may not be sufficient to stop the abusive access." The toolkits' dashboards explicitly measure this capability with the "password change survival rate" metric: the percentage of accounts that remain accessible after the victim performs a credential reset. The figure serves as a KPI for the criminal service's effectiveness and an indicator of the failure of conventional countermeasures.

"The TokenLover and YaksaLover platforms are structured as multi-tenant SaaS services and provide operators with management dashboards, campaign monitoring features, metrics on compromised accounts, and differentiated access or subscription levels." — ACN Advisory

LLM Automation: When AI Analyzes Email for Financial Fraud

TokenLover includes an LLM pipeline that automatically processes the contents of compromised mailboxes. The advisory documents three specific functions: extraction of banking coordinates from communications, identification of transaction approvers, and reconstruction of corporate communication patterns to inject fraudulent messages into existing threads.

Automated analysis reconstructs ongoing financial flows and generates fraudulent emails with timing, tone, and references consistent with the real conversation. Messages can be sent directly from compromised Microsoft 365 mailboxes, via legitimate infrastructure that "may not be sufficient" to block SPF/DKIM checks — per the advisory's cautious phrasing.

What to Do Now

The ACN advisory does not list detailed operational countermeasures, but the documented techniques point to specific actions for Microsoft 365 tenant administrators. Verifying registered devices and authentication methods on sensitive accounts is a priority: the presence of NGC keys not traceable to known corporate devices signals the persistence measured by the "password change survival rate" metric.

Monitoring active OAuth sessions and delegated device authorizations falls within the control perimeter. The Device Code Flow, while legitimate, generates authenticated sessions that appear valid in standard logging: correlating requests from geographically anomalous IPs with user authorizations becomes relevant for identifying abuse.

TokenLover's LLM pipeline reconstructs corporate communication patterns from historical email. Segmenting access to financial approvers' mailboxes and analyzing anomalies in the tone or timing of outbound messages represent controls aligned with the documented vector. The advisory emphasizes that the described techniques "are not associated with the exploitation of new zero-day vulnerabilities": they are assembly and automation of known vectors, not original exploit research.

Frequently Asked Questions

Is a password change enough to remove the compromise?

No. According to the cited advisory, a password change alone does not cut off access if the attacker has registered NGC keys or other persistent authentication methods. The "password change survival rate" metric is explicitly designed to measure this resistance.

Does MFA block this attack?

The advisory documents that the presence of multi-factor authentication "does not prevent the attack if it is the victim who authorizes the session associated with the device code." Traditional MFA is not a mitigating factor for the described vector.

Is there a CVE associated with these techniques?

The dossier does not report any associated CVEs. The described techniques — Device Code Flow abuse, token theft, NGC registration — are documented as integrated features of the toolkits, not as exploitation of zero-day vulnerabilities.

Information is based on the cited source and current as of publication.

Sources

Sources and references