Hackers Used EvilTokens, ClickFix Campaign to Attack Claude Code Users with AMOS Stealer

Over 180 phishing URLs were linked to the 'EvilTokens' campaign in March 2026; attackers abused Microsoft OAuth Device Code flow to obtain access and refresh tokens that bypass MFA and can be escalated to persistent Primary Refresh Token (PRT) access across Microsoft 365. A concurrent macOS campaign used Google Ads and ClickFix lures to deliver the AMOS stealer and a ~/.mainhelper WebSocket reverse shell targeting developers of AI tools (Claude Code, Grok, etc.). Impact is concentrated across Technology, Education, Manufacturing and Government (notably the US and India); recommended mitigations include auditing Entra ID device code sign-ins, rotating OAuth tokens, enforcing Conditional Access to restrict Device Code grants, and blocking unsigned script execution on developer macOS endpoints.

Analysis

This campaign is less a single-product failure and more a demand shock across identity and developer-endpoint controls: enterprises will accelerate spending on stronger token hygiene, device-bound auth, and developer workstation controls. Expect procurement cycles to shorten — identity & EDR vendors should see a measurable uptick in RFIs/RFPs within 30–90 days, and procurement wins convert to revenue over the following 3–12 months.

Second-order winners are vendors who can quickly operationalize anomalous OAuth/device-code telemetry (CASB/IEP vendors) and macOS-first EDRs; incumbents baked into enterprise stacks (including Microsoft) will get spend but also face reputational and regulatory scrutiny that can compress near-term multiple. A law-enforcement takedown of the PhaaS or a Microsoft platform fix could revert sentiment in weeks, whereas broad policy/regulatory changes (OAuth flow restrictions, ad platform liability) would take 6–18 months and produce durable reallocation of security budgets.

Tactically, this trade is asymmetric: a short-lived panic would be a buying opportunity for platform defenders, while sustained attacks and slower mitigations favor specialist identity and macOS security vendors. Key catalyst watchlist: Microsoft Entra AD telemetry guidance, Google Ads policy changes, and large public enterprise renewal language referencing OAuth/device-code mitigations — any of which will move relative valuations sharply within a 1–6 month window.

Key Decisions for Investors

• Long CRWD (CrowdStrike) via 6–12 month call spread: buy ATM 9-month calls, sell 30% OTM 9-month calls. Rationale: macOS/dev endpoint demand and EDR re-evaluations drive near-term bookings; target 20–40% upside if deal flow accelerates. Max loss = net premium; favorable skew to upside if analyst upgrades follow new contract announcements.
• Pair trade: long ZS (Zscaler) vs short MSFT (size ~30% of long) for 3–9 months. Rationale: CASB/Proxy vendors capture incremental OAuth visibility spend while MSFT bears reputational/regulatory risk. Target asymmetric 15–25% relative outperformance; hedge limits beta exposure to broad market moves.
• Tactical small-long JAMF (JAMF) 3–12 month position (10–15% portfolio position in security sleeve). Rationale: macOS management demand should spike among developer-heavy enterprises; aim for 25–50% upside if enterprise rollouts accelerate. Risk: concentrated exposure to slower procurement cycles.
• Protective hedge: buy 2–3 month MSFT 2.5–5% OTM puts (size as 2–3% total portfolio tail hedge). Rationale: guards against rapid multiple compression or regulatory headlines. Cost = option premium; the hedge pays off if investor sentiment deteriorates quickly.