EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
Microsoft-led disruption hits EvilTokens PhaaS after it compromised 12,000+ accounts at 10,000+ organizations; two UK suspects arrested.
Microsoft's Digital Crimes Unit coordinated the seizure of EvilTokens phishing-as-a-service infrastructure, a platform that emerged in February 2026 and compromised over 12,000 Microsoft inboxes across more than 10,000 organizations. EvilTokens was the first PhaaS to support device code authentication at scale, abusing the OAuth 2.0 device-authorization flow to bypass MFA, and offered AI-powered features for customizing lures and mining compromised inboxes for BEC targets. Two suspected administrators, aged 32 and 38, were arrested in London (Canary Wharf and Nine Elms) and released on bail. Access cost $500/month or a $1,500 one-time fee, with 44 customizable phishing kits sold on Telegram.
- Device-code phishing bypasses MFA via OAuth 2.0 device-authorization flow abuse
- 12,000+ compromised accounts across 10,000+ organizations, fueling BEC campaigns
- SpyCloud recaptured 8,708 accounts across 6,585 corporate domains in 79 countries
- Two suspected admins arrested in UK and released on bail pending investigation
- Threat remains active; clone platforms like APToken already exist
- ATT&CK
- T1566.002 Spearphishing LinkT1557 Adversary-in-the-MiddleT1550.001 Application Access TokenT1137.005 Mailbox Manipulation
- Threat actors
- Storm-2992
From the original article
4 min read at bleepingcomputer.com
The EvilTokens platform that compromised more than 12,000 Microsoft accounts at over 10,000 organizations has been disrupted in an effort led by Microsoft's Digital Crimes Unit (DCU). [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.