Loading threat actor…
saroula01 is a cybercriminal phishing operator and developer associated with the black-queen fork of Evilginx, a framework specialized in abusing Microsoft OAuth Device Code Flow to compromise Microsoft 365 accounts without directly collecting passwords. The actor’s tooling presents victims with legitimate Microsoft device codes and lures them to complete authentication on Microsoft’s real sign-in page, after which the attacker backend claims and stores the resulting OAuth tokens. This technique bypasses conventional MFA protections because the victim authenticates to legitimate Microsoft infrastructure while authorizing the attacker’s session. The actor’s known activity centers on corporate Microsoft 365 targeting and long-lived token abuse. A documented campaign active from at least June 2025 to July 2026 accumulated 218 confirmed victims across 12 countries, with approximately 94% of victims assessed as corporate accounts. Reported victim organizations included SMEs, legal practices, professional services firms, and public sector entities. Recovered operational data showed the actor maintained persistence through automatically refreshed OAuth tokens, with numerous tokens configured for background refresh and some refreshed repeatedly over extended periods. Black-queen included multiple preconfigured lure themes themed around common enterprise workflows and Microsoft-adjacent services, along with a web dashboard and Microsoft Graph-related functionality. The actor appears to have relied on public GitHub-hosted tooling and AI-assisted development for parts of the framework. Attribution beyond the handle saroula01 remains unresolved in the available evidence.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
11 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Built and operated a Microsoft 365 Device Code phishing framework that abuses OAuth Device Code Flow to capture tokens and bypass MFA; described as the largest of the three campaigns with 218 victims across 12 countries.
Cybercriminal operator behind the black-queen Evilginx fork, specializing in OAuth Device Code Flow abuse to harvest and refresh tokens at scale against predominantly corporate victims.
Ran the largest of the three phishing operations, abusing Microsoft OAuth Device Code Flow to capture and silently refresh tokens for long-term access; campaign reportedly ran for over a year and affected 218 confirmed victims across 12 countries, mostly corporate.
Running a Microsoft 365 phishing campaign based on OAuth device code flow abuse, using an Authenticator-themed lure to trick victims into completing legitimate Microsoft authentication and MFA on microsoft.com/devicelogin, after which the operator captures and refreshes tokens.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.