EvilTokens made phishing-as-a-service look easy. Then it got taken down
Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.
Microsoft, Coinbase, and law enforcement have taken down EvilTokens, a phishing-as-a-service (PhaaS) kit operated by Storm-2992 that compromised over 12,000 inboxes across 10,000 organizations. The kit used device-code phishing to bypass MFA and AI-powered tools for post-compromise reconnaissance and payment fraud. Coinbase traced $1.1 million in cryptocurrency payments, leading to an arrest by London's Metropolitan Police. The takedown involved seizing 50 websites and disabling over 175 domains.
85