Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud
Court-ordered seizure of 50 EvilTokens websites disables an AI-driven PhaaS tied to 12,000 compromised Microsoft inboxes and $1.7M reported losses.
Acting on a federal court order dated September 15, Microsoft and partners seized 50 websites and disabled more than 175 domains supporting the EvilTokens phishing-as-a-service platform, which compromised over 12,000 Microsoft email inboxes across 10,000+ organizations since February 2026. About 1,000 cybercriminals used the service, which applied AI at every attack stage, from token theft to inbox analysis for BEC targeting. Microsoft correlated at least 13 FBI IC3 complaints representing roughly $1.7 million in losses, while Coinbase traced about $1.1 million in operator revenue from more than 1,000 deposits. UK Metropolitan Police arrested two suspected operators, aged 32 and 38, on September 18, both released on bail.
- 50 websites seized and 175+ domains disabled under a federal court order
- Around 1,000 cybercriminals used the subscription service ($1,500 initiation, $500/month)
- At least $1.7M in reported fraud losses; Coinbase traced $1.1M operator revenue
- AI used to pick targets, impersonate contacts, and plan financial fraud from stolen inboxes
- Microsoft attributes the platform to Storm-2992, unaffiliated with known cybercrime groups
- ATT&CK
- T1566.002 Spearphishing LinkT1557 Adversary-in-the-MiddleT1550.001 Application Access TokenT1137.005 Mailbox Manipulation
- Threat actors
- Storm-2992
From the original article
4 min read at cyberscoop.com
The popular phishing-as-a-service platform used AI throughout the attack chain, allowing cybercriminals to steal tokens for account takeover and business email compromise. The post Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.