A financially motivated actor tracked as Doubloon Dredger is using free Notion accounts to send document-sharing notifications that arrive from Notion's own infrastructure. Sublime's Threat Intelligence & Research team identified the activity in July 2026 after a customer reported the abuse, then found matching attacks against a second organization. Details in this article come from analysis published by Infosecurity Magazine.
The mechanism is straightforward. The attacker registers a Notion account under the name of a senior executive at the target company, then shares a document with employees. Notion generates the notification email, so the message comes from a real sender on real infrastructure.
Because the notifications were generated through compromised Notion accounts, they passed DKIM, SPF and DMARC checks, according to Sublime.
That detail is the reason this matters to your email security stack. The three authentication checks that most gateways rely on to separate real senders from spoofed ones all return a pass, because nothing is being spoofed. The sender is genuinely Notion, and Notion is genuinely sending on behalf of an account someone created for free.
Clicking through takes the recipient to an intermediary PDF with a "Review and Sign" button. That button redirects to an EvilTokens device code harvesting page styled as an Adobe Acrobat document-sharing authentication screen. The page displays a verification code and tells the victim to enter it at Microsoft's legitimate login or device code entry page.
If your employee enters that code, EvilTokens receives an authorization token for their Microsoft account. No password is typed into an attacker-controlled form and no credential is captured, which is why device code phishing sidesteps the controls built to stop credential theft. The token grants account access directly, and EvilTokens ships with MailVault, a webmail client that lets the operator read and send from the compromised inbox.
EvilTokens has operated as a phishing-as-a-service platform since at least February 2026, with access sold through a private Telegram channel. That means the technique described here is not bespoke tradecraft. It is a product any paying customer can rent against your organization.
Attack Chain: From Notion Integration to Token Exfiltration
The click on a Notion notification does not go straight to a credential page. It delivers an intermediary PDF containing a "Review and Sign" button, and that button redirects the victim to an EvilTokens device code harvesting page styled as an Adobe Acrobat document-sharing authentication screen. The intermediate document stage keeps the phishing infrastructure off the original email entirely, which is why link inspection at the mail gateway sees only Notion.
The EvilTokens page displays a verification code and tells the victim to enter it at Microsoft's own login or device code entry page. That instruction is accurate, which is what makes the flow work. The victim authenticates against genuine Microsoft infrastructure, completes MFA, and in doing so authorizes the attacker's device. EvilTokens receives the resulting authorization token and gains access to the account.
This is device code phishing, mapping to MITRE ATT&CK T1528 (Steal Application Access Tokens) and T1078.004 (Valid Accounts: Cloud Accounts), with delivery through T1566.002 and user interaction under T1204.001. No password is captured and no MFA prompt is bypassed, because the victim satisfies both on the attacker's behalf. The stolen artifact is a token, meaning your password reset policy and MFA enrollment do not, by themselves, end the attacker's session.
Post-authentication, the operator works the mailbox through MailVault, a webmail client bundled into the EvilTokens platform that lets attackers read and interact with compromised inboxes directly. Mailbox access at this level supports T1114 (Email Collection) and downstream financially motivated activity such as invoice and payment redirection, which fits the actor's profile.
The PDF stage carries its own tradecraft. Sublime identified 14 additional PDFs sharing the same metadata and the same overlapping-link construction, where each document places two or three separate links over a single button. Different PDF readers resolve that stack differently, so the destination a victim reaches depends on the application they open the file in. Researchers assessed with low confidence that this provides infrastructure redundancy or complicates analysis.
Not every sample terminates at EvilTokens. Some PDFs from the same builder link to Kratos phishing pages instead, and Sublime could not determine whether the builder is shared across actors or used exclusively by Doubloon Dredger. For anyone triaging a sample, the metadata and the layered-link structure are the stronger pivot points, since the final landing page varies.
The first-stage JavaScript ties the campaign to a second platform. Sublime's analysis identified 603 related scripts across the cluster.
Tycoon2FA was disrupted by a global operation earlier and resumed activity shortly afterward. EvilTokens itself has been sold as phishing-as-a-service since at least February 2026, with access brokered through a private Telegram channel, which means the same PDF and device code chain can appear under multiple unrelated operators.
Targeting spans manufacturing, telecommunications, retail, health and logistics. The forensic trail on the victim side sits in cloud authentication records rather than on the endpoint, since a successful compromise produces a legitimate device code grant tied to attacker-controlled hardware and no malware on the workstation at all.
Business and Compliance Impact of Stolen Authentication Tokens
A stolen authentication token is not a password, and that difference changes what your incident response team is dealing with. The token EvilTokens obtains is the artifact Microsoft issues after your multi-factor prompt has already been satisfied, so the attacker inherits an approved session without ever needing your user's password or a second factor. Forcing a password reset on the affected account does not, by itself, end that session.
That is why token theft shows up differently in your logs. The attacker's activity appears as a legitimate, authenticated session belonging to a real employee, which means the mailbox reads, file access and directory queries that follow all carry a valid identity. When you later reconstruct the incident, you are separating authorized user behavior from attacker behavior inside the same account, and that work is slow and expensive.
Sublime notes that the EvilTokens platform also provides MailVault, a webmail client built for interacting with compromised inboxes. Practically, that gives the operator a working mail interface into your employee's account rather than a scripted dump. Mailbox access at that level supports reading contract negotiations, searching for banking and invoice threads, pulling attachments containing regulated data, and sending internal messages that your staff will treat as genuine because they are genuine.
The targeting pattern matters for your regulatory exposure. The 14 additional PDFs Sublime identified with matching metadata hit organizations across manufacturing, telecommunications, retail, health and logistics, and each of those sectors carries a different reporting obligation once a mailbox is confirmed accessed:
- If you operate in health, mailbox contents holding patient identifiers put you into HIPAA breach assessment territory, and the assessment starts from the assumption of disclosure unless you can demonstrate otherwise.
- If you take card payments, cardholder data or support correspondence sitting in an executive inbox pulls the incident into PCI-DSS scope and involves your acquirer.
- If you hold SOC 2 or ISO 27001 attestation, an authentication bypass affecting an in-scope identity system becomes a finding your auditor will examine at the next assessment, and customers with contractual notification clauses will ask for a written account.
Your notification clock is driven by what you cannot rule out. Because a valid session leaves ordinary-looking access records, proving that an attacker did not open a particular message is harder than proving they did. Counsel will generally advise notifying on the broader set, which increases the number of affected individuals, customers and partners you contact and the cost of doing so.
Scale is worth flagging at board level. Sublime's analysis identified 603 related first-stage scripts, with 416 decoding to EvilTokens and 187 to Tycoon2FA, and assessed with moderate confidence that Doubloon Dredger buys from both platforms. EvilTokens has been sold as a service through a private Telegram channel since at least February 2026. Some of the PDF samples pointed to Kratos phishing pages instead, which tells you the same delivery method feeds multiple harvesting back ends.
The business framing for your leadership is straightforward. A single employee who follows an instruction that is technically accurate can hand an attacker an authenticated session into your Microsoft 365 tenant, and the resulting investigation touches legal, compliance, audit and customer communications well beyond the security team's budget line.
Detection and Response: Immediate Actions for Compromised Environments
Start by revoking active refresh tokens for every account that received one of these Notion notifications, not only the accounts you have confirmed as compromised. In Entra ID, revoke sessions across the affected users and then check whether any new device code authentications appear afterward, which tells you whether the attacker still holds a working grant.
Once sessions are cut, pull your sign-in logs and filter for the device code authentication flow. That flow is rare in most organizations, so nearly every hit is worth reviewing. Pay attention to sign-ins where the device code request and the code redemption come from different IP addresses or different countries, since that split is the mechanical signature of a victim entering a code generated on the attacker's machine.
- Entra ID sign-in logs: device code flow entries, non-interactive sign-ins tied to the same session, and unfamiliar client applications requesting Microsoft Graph or Exchange scopes.
- Unified audit log: new inbox rules, mail forwarding changes, and bulk message reads following a device code sign-in. MailVault, the webmail client bundled with the EvilTokens platform, drives inbox activity through the stolen grant, so the reads look ordinary in isolation and only stand out against the sign-in timeline.
- Mail gateway and URL logs: retrieve the delivered PDFs rather than the message bodies. Sublime found 14 additional PDFs sharing the same metadata, each carrying two or three overlapping links stacked over a single button, so the destination you extract depends on which PDF reader parsed it. Extract all embedded URIs, not just the one your tooling resolves.
Search your web proxy logs for the first-stage JavaScript associated with this delivery chain. Sublime's analysis identified 603 related scripts, of which 416 decoded to EvilTokens and 187 to Tycoon2FA, and assessed with moderate confidence that Doubloon Dredger buys from both. Treat a hit on either as the same incident type, and check whether the same PDF batch also pointed users at Kratos phishing pages, which appeared in some samples from this builder.
In environments Capstone manages, Adlumin correlates device code sign-ins against normal authentication behavior for each user, which surfaces a redeemed token arriving from an IP the account has never used before the mailbox activity begins.
For containment, disable device code authentication outright through Conditional Access if your environment has no legitimate use for it. Sublime's recommendation is direct on this point. Where you do need it for shared devices, kiosks, or conference room hardware, scope a Conditional Access policy that permits device code token generation only from compliant, enrolled devices and blocks it everywhere else. That single control removes the mechanism this campaign depends on.
Longer term, review the OAuth applications and consented permissions in your tenant and remove any grant your users approved that you cannot tie to an approved business purpose. Set token lifetimes so that a stolen grant expires in hours rather than persisting for weeks, and enable continuous access evaluation so that a revocation event terminates active sessions instead of waiting for the next token refresh.
Finally, brief your finance, HR, and executive assistant teams specifically. The campaign targeted manufacturing, telecommunications, retail, health, and logistics organizations using notifications that impersonate a senior executive, and the people who routinely receive documents from leadership are the ones who will see these first. Tell them that a legitimate document share never asks them to type a code into a Microsoft login screen.
Hardening Notion Integrations and Token Storage
The single highest-value control here is a Conditional Access policy in Entra ID that blocks the device code authentication flow outright. Sublime's recommendation is to disable device code authentication where possible, or to restrict token generation to trusted devices, and Entra's authentication flows condition lets you do exactly that without touching the rest of your sign-in policy.
Before you flip it to Block, run the policy in report-only mode for a week and see who actually redeems device codes. In most organizations the legitimate users are a short list: conference room displays, PowerShell and CLI tooling, and a handful of shared devices with no browser. Scope an exception group to those accounts and require the sign-in to come from a compliant or hybrid-joined device, so a code redeemed on unmanaged hardware fails.
The Notion side needs a separate pass, because the workspace itself is an access surface even when no one has been phished. Start with an inventory of what connects to it:
- Internal integrations built by your own developers, each holding a long-lived integration secret
- Public integrations and third-party connectors your teams installed themselves (automation platforms, form tools, CRM syncs)
- Service accounts used for API access, including any created during a proof of concept and never removed
- Guest accounts and external collaborators with page-level shares
Anything on that list you cannot name an owner for should be revoked, not documented for later review. Set your workspace to require admin approval for new integrations so a single employee cannot connect an unvetted tool to shared pages.
For the integrations you keep, scope each one to the specific pages or databases it needs and grant only the capabilities it uses. An automation that posts status updates needs insert and update access to one database. It does not need read access to user information including email addresses, which is the capability that turns a leaked secret into a roster of your staff for the next round of executive-impersonation lures.
Token storage is where these secrets usually go wrong. Integration secrets and OAuth refresh tokens belong in an encrypted secrets manager with access logging, retrieved at runtime by the application identity. They do not belong in .env files, appsettings.json, CI/CD variables that print to build logs, or anywhere a repository scan will find them. Prefer OAuth flows that issue short-lived access tokens with refresh handling over persistent internal secrets, and set a rotation schedule for the secrets that cannot be replaced that way.
Enforce SSO with MFA on every Notion workspace admin, and keep the admin count small enough that you can list the names from memory. Turn on enforced SAML login for your verified domain so someone cannot register a personal Notion account on a company email address and operate outside your identity controls. Where your plan supports SCIM, wire deprovisioning to your directory so a departing employee's workspace access ends with their mailbox.
For containment, treat a leaked integration secret the same way you treat a stolen session. Revoke the integration in the Notion admin console first, which invalidates the token immediately, then review the audit log for what that integration read or exported while the secret was valid. Re-issue a new secret only after the storage problem that exposed the old one has been fixed, and confirm the replacement is scoped to the narrower page set rather than the workspace root.
Key Takeaway: Token Lifecycle Governance as the Core Defense
Doubloon Dredger builds none of the tooling it uses. Sublime assessed with moderate confidence that the actor is a paying customer of two phishing-as-a-service platforms at once, based on 603 related first-stage scripts, of which 416 decoded to EvilTokens and 187 to Tycoon2FA. The delivery method you block this quarter is rented, and the tenant renting it can swap suppliers in an afternoon.
That is the practical reason token governance matters more than any single indicator you add to a blocklist. The same PDF builder produced 14 additional documents with matching metadata, some pointing to Kratos pages instead of EvilTokens, aimed at organizations in manufacturing, telecommunications, retail, health and logistics. Each PDF carried two or three links stacked over one button, so the destination your users reach depends on which PDF reader they happen to open. Your control surface at the delivery stage is genuinely unstable.
What stays constant is the authentication token itself. Every variant in this cluster ends at the same place, an approved session on your Microsoft tenant, plus the attacker-side webmail client that reads it. When Tycoon2FA was disrupted in a global operation, it resumed activity shortly afterward, which tells you how much durable protection takedowns buy you.
Treat issuance, lifetime, storage and revocation of tokens as a governed control with a named owner, the way you already govern privileged accounts. The single action worth scheduling this month is an audit of every active token grant in your tenant, paired with automated revocation triggered by usage patterns that do not match the user's normal device and location.
