Opinion: EvilTokens shows AI speeding Microsoft 365 device-code phishing
Microsoft said it disrupted Storm-2992 in September after the service, found in February, used AI across the chain.
32
Threat actor
Storm-2992
- Mentions · 7d0
- Mentions · 30d1
- All mentions8
- First seenSep 22, 2026
- Last mentioned16d ago
Timeline
8 articles · newest firstEvilTokens made phishing-as-a-service look easy. Then it got taken down
Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.
85
The Phishing Kit That Turned Microsoft’s Login Flow Into an AI-Powered Fraud Machine
EvilTokens PhaaS kit uses AI and device-code phishing to bypass MFA, compromising 12,000+ corporate inboxes for payment fraud.
80
Microsoft Warns of EvilTokens AI Phishing Service Hijacking Thousands of Accounts
EvilTokens PaaS hijacks device-code auth to steal tokens and enable BEC at scale, compromising 12,000+ inboxes across 10,000+ organizations.
85
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft dismantled EvilTokens, an AI-assisted device-code phishing service linked to about 12,000 inbox takeovers.
76
Unmasking EvilTokens: Getting to the root of device code phishing
Microsoft details the EvilTokens/Storm-2992 device-code phishing operation and shares Defender detections after disrupting the AI-powered platform.
76
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
Microsoft-led disruption hits EvilTokens PhaaS after it compromised 12,000+ accounts at 10,000+ organizations; two UK suspects arrested.
73
Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud
Court-ordered seizure of 50 EvilTokens websites disables an AI-driven PhaaS tied to 12,000 compromised Microsoft inboxes and $1.7M reported losses.
74
Appears with
- Microsoftorganization · 7
- EvilTokensmalware · 5
- Microsoftvendor · 5
- SpyCloudorganization · 4
- Cloudflareorganization · 3
- EvilTokensorganization · 3
- Microsoft Digital Crimes Unitorganization · 3
- Health-ISACorganization · 3
- OpenAIorganization · 3
- Coinbaseorganization · 3
- TRM Labsorganization · 2
- Railwayorganization · 2
- Microsoft 365product · 2
- Microsoft Entra IDproduct · 2
- Coinbasevendor · 2
- Shadowserverorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.