Threats · 50 days ago
Microsoft and partners disrupted EvilTokens after the phishing service was tied to more than 12,000 compromised inboxes at over 10,000 organizations. With court authorization, the coalition seized 50 websites, disabled 150+ domains, and notified affected customers while the Metropolitan Police said two suspects were arrested separately in London on Sept. 11.
EvilTokens used Microsoft’s legitimate sign-in page to trick victims into entering an authentication code, which gave the operators a live session instead of a password. Once inside, an AI chatbot could read and sort mail for wire-transfer threads, invoices, trusted contacts, and likely impersonation targets, which cut the time between mailbox access and fraud.
The lasting exposure is the mailbox session, not the lure that started it. In organizations that approve payment or bank-detail changes over email, a compromise can keep feeding payment-fraud work even after a password reset if sessions and tokens are still live.
12 sources covering this story
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
The cybercrime platform leveraged AI at every step of the attack chain, including writing social engineering messages and deciding targets.
EvilTokens, a phishing service that compromised over 12,000 inboxes and used AI to find fraud targets, has been disrupted.
OAuth Token Theft Through Microsoft's Front Door | Huntress
No phishing domain, no spoofed UI, no browser.
Microsoft Disrupts EvilTokens Device Code Phishing Service
Microsoft disrupted the EvilTokens phishing platform, which used AI-powered device code phishing to compromise thousands of organizations globally.
Microsoft disrupts AI-assisted platform that compromised 12,000 accounts
EvilTokens provided an end-to-end platform that makes mass compromises faster and easier.
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft disrupted EvilTokens after it was linked to more than 12,000 compromised inboxes across over 10,000 organizations.
Microsoft’s EvilTokens takedown sheds light on state of AI-powered cybercrime
Surreptitiously gaining persistent access to compromised Microsoft 365/Entra ID accounts, the group also offered an AI-powered chatbot to facilitate BEC scams.
UK cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites
Used by crims to compromise 12K+ email inboxes across 10K+ global orgs
The Record from Recorded Future
Two arrested in UK after Microsoft takedown of ‘Eviltokens’ AI-chatbot for cybercriminals
Available on Telegram for a $1,500 initiation fee and a recurring monthly $500 subscription, EvilTokens provided cybercriminals with artificial intelligence tools enabling them to compromise accounts, analyze breached inboxes and find the best methods for monetizing their access through fraud.
Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud
The popular phishing-as-a-service platform used AI throughout the attack chain, allowing cybercriminals to steal tokens for account takeover and business email compromise.
Unmasking EvilTokens: Getting to the root of device code phishing | Microsoft Security Blog
In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption of EvilTokens infrastructure and operations.
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
The EvilTokens platform that compromised more than 12,000 Microsoft accounts at over 10,000 organizations has been disrupted in an effort led by Microsoft's Digital Crimes Unit (DCU).
Part of the PlainSec briefing for 2026-09-24