Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes
Microsoft and partners seized EvilTokens infrastructure after the phishing service compromised over 12,000 inboxes.
84
Threat actor
EvilTokens
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 22, 2026
- Last mentionedSep 23, 2026
Timeline
3 articles · newest firstMicrosoft’s EvilTokens takedown sheds light on state of AI-powered cybercrime
Microsoft seized EvilTokens infrastructure after the AI phishing service compromised about 12,000 Microsoft 365 inboxes.
82
Microsoft Disrupts EvilTokens Device Code Phishing Service
Microsoft seized 50 sites and disabled over 150 domains used by EvilTokens to phish Microsoft 365 accounts.
68
Appears with
- Microsoftvendor · 3
- Microsoftorganization · 3
- Microsoft 365product · 3
- Coinbaseorganization · 2
- Railwayorganization · 1
- Entra IDproduct · 1
- The Shadowserver Foundationorganization · 1
- Cloudflareorganization · 1
- Health-ISACorganization · 1
- SpyCloudorganization · 1
- Metropolitan Police Serviceorganization · 1
- OpenAIorganization · 1
- TRM Labsorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.