The Threat to Legal Privilege
Microsoft has successfully disrupted EvilTokens, a sophisticated phishing-as-a-service (PhaaS) platform that utilized AI-driven tactics to bypass traditional security controls. The operation compromised over 12,000 Microsoft 365 accounts across 10,000 organizations. For solo and small law firms, this represents a critical reminder of the vulnerability of cloud-based practice management ecosystems.
The EvilTokens platform relied on device code phishing—a method that tricks users into authorizing a malicious device to access their account, effectively bypassing standard Multi-Factor Authentication (MFA). When successful, these attackers gain persistent access to sensitive emails, client discovery documents, and billing data.
Why This Matters for Your Firm
- Duty of Confidentiality: Under ABA Model Rule 1.6, attorneys have a mandatory duty to take "reasonable measures" to prevent unauthorized access to client information. Falling victim to a known phishing scheme via an insecure M365 configuration may be viewed as a failure of this duty.
- Malpractice Exposure: A breach of client files resulting from a avoidable phishing attack provides a clear path for malpractice claims and ethical grievances.
- Bar Compliance: Regulatory bodies are increasingly scrutinizing the use of cloud services. If your firm’s digital environment is compromised, you must be prepared to demonstrate that you implemented industry-standard security, such as FIDO2-compliant hardware keys, which remain resistant to these types of phishing attacks.
Actionable Step: Audit your Microsoft 365 tenant logs for suspicious device code authorizations. If your firm still relies solely on SMS or prompt-based MFA, now is the time to migrate to passwordless authentication or physical security keys. Relying on basic MFA is no longer sufficient to meet the modern standard of care for protecting privileged client data.