Two big stories from Microsoft landed within days of each other.

First, EvilTokens. Last week, Nathan Taylor told us some of his co-managed clients were getting compromised through device code flow. Then Microsoft published a report showing just how big this got. EvilTokens is phishing sold as a subscription, and it uses AI at every step. It hit more than 12,000 inboxes across over 10,000 organizations, and the victims land on the real Microsoft sign-in page.

Second, Microsoft announced what Satya calls the biggest Copilot update yet: Home, Code and Autopilot. Autopilot is an agent with its own identity that works in your tenant around the clock. Code lets anyone build apps, and a lot of it runs on usage-based billing.

Put those two stories side by side. Attackers are stealing tokens at scale, and Microsoft is about to put autonomous agents with their own identities into every tenant we manage. That's a big opportunity and a big responsibility for MSPs.

To help us make sense of it, we've got the perfect guest. Dux Raymond Sy, Chief Transformation Officer at Avepoint.

Here's the story from Microsoft: https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/?_sp=f01b38e4-937e-48d4-b3ed-b1afe836185d.1790118273927