Huntress ranks RMM abuse and mailbox attacks atop SMB threats
Huntress says RMM abuse was 45% of Q1 2026 endpoint incidents and mailbox manipulation 24.6% of 2026 ITDR signals.
32
Malware
EvilTokens
- Mentions · 7d2
- Mentions · 30d3
- All mentions13
- First seenSep 17, 2026
- Last mentioned5d ago
Timeline
13 articles · newest firstOpinion: EvilTokens shows AI speeding Microsoft 365 device-code phishing
Microsoft said it disrupted Storm-2992 in September after the service, found in February, used AI across the chain.
32
Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
Huntress says the EvilTokens device-code phishing kit hit 344 organizations without breaking passkey cryptography.
62
Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
Huntress finds RMM abuse, mailbox-rule BEC, and AiTM token theft most often disrupt SMBs.
68
Phishing Response: 3 Steps SOC Teams Can Take to Investigate Threats Faster
ANY.RUN pitched sandbox updates that speed phishing triage, using an EvilTokens device-code campaign as the example.
28
Phishing Response Protocol: 3 Essential SOC Steps Powered by ANY.RUN’s Latest Product Updates
ANY.RUN promotes three SOC steps for faster phishing response using new sandbox and reporting features.
30
How device code phishing gives scammers access to your account
Device code phishing tricks users into approving a real OAuth sign-in, handing attackers account tokens.
46
EvilTokens made phishing-as-a-service look easy. Then it got taken down
Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.
85
The Phishing Kit That Turned Microsoft’s Login Flow Into an AI-Powered Fraud Machine
EvilTokens PhaaS kit uses AI and device-code phishing to bypass MFA, compromising 12,000+ corporate inboxes for payment fraud.
80
Microsoft Warns of EvilTokens AI Phishing Service Hijacking Thousands of Accounts
EvilTokens PaaS hijacks device-code auth to steal tokens and enable BEC at scale, compromising 12,000+ inboxes across 10,000+ organizations.
85
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft dismantled EvilTokens, an AI-assisted device-code phishing service linked to about 12,000 inbox takeovers.
76
UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites
UK police arrested two EvilTokens admins as Microsoft seized sites used to phish over 12,000 inboxes.
77
How MSSPs Can Prove Their Value When “Nothing Happened”
ANY.RUN outlines how MSSPs can demonstrate SOC value by reporting investigation outcomes, threat patterns, and response metrics using its sandbox products.
12
Appears with
- Microsoftvendor · 10
- Microsoftorganization · 9
- Storm-2992threat actor · 5
- Microsoft 365product · 5
- Huntressorganization · 4
- Railwayorganization · 4
- Coinbaseorganization · 3
- SpyCloudorganization · 3
- Health-ISACorganization · 3
- OpenAIorganization · 3
- ANY.RUNvendor · 3
- Cloudflareorganization · 3
- Coinbasevendor · 2
- FBIorganization · 2
- TRM Labsorganization · 2
- Microsoft Entra IDproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.