Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud
Court-ordered seizure of 50 EvilTokens websites disables an AI-driven PhaaS tied to 12,000 compromised Microsoft inboxes and $1.7M reported losses.
74
Organization
Microsoft Digital Crimes Unit
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 22, 2026
- Last mentionedSep 22, 2026
Timeline
3 articles · newest firstEvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
Microsoft-led disruption hits EvilTokens PhaaS after it compromised 12,000+ accounts at 10,000+ organizations; two UK suspects arrested.
73
Unmasking EvilTokens: Getting to the root of device code phishing
Microsoft details the EvilTokens/Storm-2992 device-code phishing operation and shares Defender detections after disrupting the AI-powered platform.
76
Appears with
- Microsoftorganization · 3
- Storm-2992threat actor · 3
- EvilTokensorganization · 3
- SpyCloudorganization · 2
- Metropolitan Policeorganization · 2
- Health-ISACorganization · 1
- TRM Labsorganization · 1
- OpenAIorganization · 1
- Coinbaseorganization · 1
- Shadowserverorganization · 1
- Cloudflareorganization · 1
- Microsoft Threat Intelligenceorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.