A financially motivated threat actor, tracked as Doubloon Dredger, has been observed leveraging free Notion accounts, malicious PDFs, and device code phishing to compromise organizational accounts and harvest authentication tokens. The activity, identified in July 2026 by Sublime's Threat Intelligence & Research team, began after a customer reported Notion abuse, leading to the discovery of similar attacks against another organization.
The campaigns involve sending document-sharing notifications from legitimate Notion infrastructure using fake accounts that impersonate senior executives. These emails, generated through compromised Notion accounts, successfully pass DKIM, SPF, and DMARC checks, lending them an air of legitimacy.
Recipients who click on the notification are first directed to an intermediary PDF. Within this PDF, a "Review and Sign" button then redirects the victim to a device code harvesting page. This page is designed to mimic an Adobe Acrobat document-sharing authentication screen, providing a verification code and instructions to enter it on Microsoft's legitimate login or device code entry page. If the victim follows these instructions and enters the code, the attacker gains an authorization token, enabling access to the compromised account.
The phishing-as-a-service (PaaS) platform used for this, known as EvilTokens, has been available since at least February 2026, with access sold through a private Telegram channel. EvilTokens also offers MailVault, a webmail client that allows attackers to interact with compromised inboxes.
Sublime's research uncovered 14 additional PDFs with identical metadata and overlapping link structures. These PDFs contained multiple links overlaid on the same button, which could lead to different destinations depending on the PDF reader used. Researchers speculate this might serve as infrastructure redundancy or a method to complicate defensive analysis. These PDFs targeted organizations across various sectors, including manufacturing, telecommunications, retail, health, and logistics. Some samples from these campaigns linked to Kratos phishing pages instead of EvilTokens.
While Sublime could not definitively determine if the PDF builder was shared among different threat actors or exclusively used by Doubloon Dredger, similarities were noted between the campaign's first-stage JavaScript and activity associated with the Tycoon2FA device code harvesting platform. Analysis identified 603 related scripts, with 416 decoding to EvilTokens and 187 to Tycoon2FA. Researchers assess with moderate confidence that Doubloon Dredger is a customer of both PaaS platforms. This activity follows a global operation that disrupted Tycoon2FA months prior, though the platform quickly resumed operations.
Organizations are advised to disable device code authentication where feasible or to restrict device code token generation to trusted devices to mitigate such threats.
