The Shadowserver Foundation (Organization): news timeline & CVEs

AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft

Microsoft disrupted EvilTokens, an AI-powered phishing platform that compromised 12,000+ email accounts across 10,000+ organizations.

Microsoft disrupted EvilTokens, an AI-powered phishing platform that compromised over 12,000 email accounts at more than 10,000 organizations. The platform used AI to automate device code phishing and account reconnaissance, requiring a $1,500 initial fee and $500 monthly subscription. Two suspects were arrested in the UK, and Microsoft seized 50 websites, with support from partners including SpyCloud, Coinbase, and OpenAI.

SecurityWeekSep 23, 11:23 UTC · 3d agoPhishing & fraud in the wild 14 sources1

Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes

Microsoft and partners seized EvilTokens infrastructure after the phishing service compromised over 12,000 inboxes.

Microsoft, with court authorization and partners including Health-ISAC, Cloudflare, Coinbase, and OpenAI, disrupted the EvilTokens phishing service, which compromised more than 12,000 inboxes at over 10,000 organizations. Victims entered an authentication code on Microsoft's legitimate sign-in page, granting persistent token access that could survive a password reset. The service's AI tools summarized and translated mail, identified payment contacts, and drafted impersonation messages. It sold on Telegram for a $1,500 fee plus $500 recurring. On September 11, 2026, London police arrested two men, and Microsoft seized 50 sites and disabled more than 150 domains.

Help Net Securityupdated Sep 23, 11:23 UTC · 3d agofirst Sep 23, 08:34 UTC · 4d agoPhishing & fraud in the wild 14 sources

Two arrested in UK after Microsoft takedown of ‘Eviltokens’ AI-chatbot for cybercriminals

Microsoft's court-authorized takedown of the EvilTokens AI phishing platform led to two UK arrests; the service had access to 12,000+ compromised inboxes.

Microsoft's Digital Crimes Unit, partnering with Health-ISAC and OpenAI, used a US court order to dismantle EvilTokens, a Telegram-sold AI chatbot service ($1,500 initiation plus $500 monthly) that automated phishing, inbox analysis and fraud targeting. UK Metropolitan Police arrested two men, aged 32 and 38, who were released on bail; Microsoft seized 50 websites and disabled 150 domains. EvilTokens launched in February 2026 and was linked to more than 12,000 compromised inboxes across 10,000+ organizations, concentrated in the US, Canada, UK, Australia, India and France. Its device code phishing flow let criminals hijack sessions on devices that cannot support standard sign-in methods.

The Recordupdated Sep 23, 11:23 UTC · 3d agofirst Sep 22, 15:51 UTC · 4d agoPolicy & legal 14 sources

UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites

UK police arrested two EvilTokens admins as Microsoft seized sites used to phish over 12,000 inboxes.

Microsoft and partners disrupted EvilTokens, a device-code phishing kit sold as a service that compromised more than 12,000 email inboxes at over 10,000 organizations. The kit bypassed MFA to access Microsoft 365 and used an AI chatbot to analyze inboxes and select impersonation and fraud tactics. After a US court order, Microsoft seized 50 websites and disabled more than 150 related domains, with Health-ISAC as co-plaintiff. On September 18, London's Metropolitan Police arrested two alleged administrators, ages 32 and 38, who were later released on bail.

The Register · Securityupdated Sep 23, 11:23 UTC · 3d agofirst Sep 22, 15:00 UTC · 4d agoPhishing & fraud in the wild 14 sources

The Shadowserver Foundation

Timeline4 articles

Appears with

AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft

Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes

Two arrested in UK after Microsoft takedown of ‘Eviltokens’ AI-chatbot for cybercriminals

UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites