Storm-2992 (Threat actor): news timeline & CVEs

EvilTokens made phishing-as-a-service look easy. Then it got taken down

Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.

Microsoft, Coinbase, and law enforcement have taken down EvilTokens, a phishing-as-a-service (PhaaS) kit operated by Storm-2992 that compromised over 12,000 inboxes across 10,000 organizations. The kit used device-code phishing to bypass MFA and AI-powered tools for post-compromise reconnaissance and payment fraud. Coinbase traced $1.1 million in cryptocurrency payments, leading to an arrest by London's Metropolitan Police. The takedown involved seizing 50 websites and disabling over 175 domains.

Security Affairsupdated Sep 23, 11:23 UTC · 3d agofirst Sep 23, 11:00 UTC · 3d agoPhishing & fraud in the wild 14 sources

The Phishing Kit That Turned Microsoft’s Login Flow Into an AI-Powered Fraud Machine

EvilTokens PhaaS kit uses AI and device-code phishing to bypass MFA, compromising 12,000+ corporate inboxes for payment fraud.

EvilTokens is a phishing-as-a-service (PhaaS) kit that has compromised over 12,000 inboxes at more than 10,000 organizations by exploiting Microsoft's device-code sign-in flow. The kit, operated by Storm-2992, uses AI to generate targeted lures and automate post-compromise reconnaissance for business email compromise (BEC). Once access is gained, attackers register new devices and create hidden inbox rules to maintain persistence and evade detection.

Cyber Security Newsupdated Sep 23, 11:23 UTC · 3d agofirst Sep 23, 10:59 UTC · 3d agoPhishing & fraud in the wild 14 sources

Microsoft Warns of EvilTokens AI Phishing Service Hijacking Thousands of Accounts

EvilTokens PaaS hijacks device-code auth to steal tokens and enable BEC at scale, compromising 12,000+ inboxes across 10,000+ organizations.

Microsoft warns that the EvilTokens phishing-as-a-service platform has compromised over 12,000 email inboxes across 10,000+ organizations since February 2026. The platform, linked to threat actor Storm-2992, industrializes device-code authentication hijacking for large-scale token theft and business email compromise. EvilTokens uses AI to generate tailored lures and sophisticated infrastructure to evade detection.

GBHackersupdated Sep 23, 11:23 UTC · 3d agofirst Sep 23, 10:25 UTC · 3d agoPhishing & fraud in the wild 14 sources

Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises

Microsoft dismantled EvilTokens, an AI-assisted device-code phishing service linked to about 12,000 inbox takeovers.

Microsoft's Digital Crimes Unit, under an order from the U.S. District Court for the Eastern District of Virginia and with partners including Health-ISAC, Cloudflare, Coinbase, and OpenAI, dismantled EvilTokens, a phishing-as-a-service platform tied to about 12,000 inbox compromises. Microsoft tracks the operators as Storm-2992, and the Metropolitan Police Service arrested two men, ages 32 and 38, on September 11, 2026. The kit abused the OAuth 2.0 device-code flow so victims entered codes at Microsoft's real login page, giving attackers access and refresh tokens used for mailbox theft, hidden inbox rules, and business email compromise. Products sold for $600 to $1,500 plus a $500 monthly fee, and Coinbase traced about $1.1 million in Tron revenue from October 2025 to June 2026.

The Hacker Newsupdated Sep 23, 11:23 UTC · 3d agofirst Sep 22, 17:03 UTC · 4d agoPhishing & fraud in the wild 14 sources

Unmasking EvilTokens: Getting to the root of device code phishing

Microsoft details the EvilTokens/Storm-2992 device-code phishing operation and shares Defender detections after disrupting the AI-powered platform.

Microsoft Threat Intelligence published comprehensive analysis of EvilTokens, a PhaaS tracked to actor Storm-2992 that compromised more than 12,000 inboxes at over 10,000 organizations worldwide since February 2026. The platform abused the OAuth device code authentication flow to bypass MFA, then used stolen tokens for mailbox persistence via malicious inbox rules and new device grants, with Microsoft Graph reconnaissance for mapping organizations and lateral movement. Delivery used 44 lure themes (invoices, RFPs, shared files) with malicious URLs, PDFs, HTML files, and thousands of short-lived Node.js polling nodes to evade detection. Microsoft recommends blocking device code flow wherever possible and provides Defender detection and hunting guidance plus mail-flow hardening steps.

Microsoft Security Blogupdated Sep 23, 11:23 UTC · 3d agofirst Sep 22, 15:00 UTC · 4d agoPhishing & fraud in the wild 14 sources

EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts

Microsoft-led disruption hits EvilTokens PhaaS after it compromised 12,000+ accounts at 10,000+ organizations; two UK suspects arrested.

Microsoft's Digital Crimes Unit coordinated the seizure of EvilTokens phishing-as-a-service infrastructure, a platform that emerged in February 2026 and compromised over 12,000 Microsoft inboxes across more than 10,000 organizations. EvilTokens was the first PhaaS to support device code authentication at scale, abusing the OAuth 2.0 device-authorization flow to bypass MFA, and offered AI-powered features for customizing lures and mining compromised inboxes for BEC targets. Two suspected administrators, aged 32 and 38, were arrested in London (Canary Wharf and Nine Elms) and released on bail. Access cost $500/month or a $1,500 one-time fee, with 44 customizable phishing kits sold on Telegram.

BleepingComputerupdated Sep 23, 11:23 UTC · 3d agofirst Sep 22, 15:00 UTC · 4d agoPhishing & fraud in the wild 14 sources

Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud

Court-ordered seizure of 50 EvilTokens websites disables an AI-driven PhaaS tied to 12,000 compromised Microsoft inboxes and $1.7M reported losses.

Acting on a federal court order dated September 15, Microsoft and partners seized 50 websites and disabled more than 175 domains supporting the EvilTokens phishing-as-a-service platform, which compromised over 12,000 Microsoft email inboxes across 10,000+ organizations since February 2026. About 1,000 cybercriminals used the service, which applied AI at every attack stage, from token theft to inbox analysis for BEC targeting. Microsoft correlated at least 13 FBI IC3 complaints representing roughly $1.7 million in losses, while Coinbase traced about $1.1 million in operator revenue from more than 1,000 deposits. UK Metropolitan Police arrested two suspected operators, aged 32 and 38, on September 18, both released on bail.

CyberScoopupdated Sep 23, 11:23 UTC · 3d agofirst Sep 22, 15:00 UTC · 4d agoPhishing & fraud in the wild 14 sources

Storm-2992

Timeline7 articles

Appears with