How RMM abuse gives attackers a way in that looks like business as usual
Huntress reports attacker RMM abuse in 45% of Q1 2026 endpoint incidents, up 277% YoY, delivered via phishing lures stacking multiple remote-access tools.
70
Organization
EvilTokens
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenSep 22, 2026
- Last mentionedOct 5, 2026
Timeline
7 articles · newest firstSocial Engineering in the Age of Synthetic Media
Recorded Future details how threat actors abuse jailbroken and legitimate AI tools to scale phishing, deepfake impersonation, and phishing-as-a-service operations.
55
Microsoft disrupts AI-assisted platform that compromised 12,000
Microsoft seized EvilTokens, an AI-chatbot BEC platform that compromised 12,000 accounts across 10,000 organizations.
75
Two arrested in UK after Microsoft takedown of ‘Eviltokens’ AI-chatbot for cybercriminals
Microsoft's court-authorized takedown of the EvilTokens AI phishing platform led to two UK arrests; the service had access to 12,000+ compromised inboxes.
58
Unmasking EvilTokens: Getting to the root of device code phishing
Microsoft details the EvilTokens/Storm-2992 device-code phishing operation and shares Defender detections after disrupting the AI-powered platform.
76
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
Microsoft-led disruption hits EvilTokens PhaaS after it compromised 12,000+ accounts at 10,000+ organizations; two UK suspects arrested.
73
Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud
Court-ordered seizure of 50 EvilTokens websites disables an AI-driven PhaaS tied to 12,000 compromised Microsoft inboxes and $1.7M reported losses.
74
Appears with
- Microsoftorganization · 5
- Storm-2992threat actor · 3
- SpyCloudorganization · 3
- Microsoft Digital Crimes Unitorganization · 3
- Metropolitan Policeorganization · 2
- Metropolitan Police Serviceorganization · 2
- TRM Labsorganization · 2
- OpenAIorganization · 2
- Cloudflareorganization · 2
- Health-ISACorganization · 2
- The Shadowserver Foundationorganization · 1
- Recorded Futureorganization · 1
- Tifluxorganization · 1
- Shadowserverorganization · 1
- Microsoft Threat Intelligenceorganization · 1
- Lovableorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.