Microsoft’s EvilTokens takedown sheds light on state of AI-powered cybercrime
Microsoft seized EvilTokens infrastructure after the AI phishing service compromised about 12,000 Microsoft 365 inboxes.
Microsoft disrupted EvilTokens, an AI-powered phishing-as-a-service platform active since February 2026 and linked to more than 12,000 compromised Microsoft 365 inboxes at over 10,000 organizations. The service abused the OAuth 2.0 device-code flow so victims entered a code on Microsoft’s real login page and handed over session tokens without passwords, then used an AI chatbot to mine mailboxes for business-email-compromise opportunities. Pricing was a $1,500 signup and $500 per month. A US court order let Microsoft seize 50 websites and more than 150 domains, and UK police arrested two men, ages 32 and 38, who were later released on bail. Coinbase traced about $1.1 million across more than 700 crypto addresses.
- More than 12,000 Microsoft 365 inboxes at over 10,000 organizations compromised
- Device-code phishing stole OAuth tokens without collecting passwords
- An AI chatbot scanned mailboxes to prepare business email compromise
- Microsoft seized 50 sites and over 150 domains under a US court order
- UK police arrested two suspected operators, both later released on bail
- ATT&CK
- T1566.002 Spearphishing LinkT1528 Steal Application Access TokenT1550.001 Application Access TokenT1114.002 Remote Email CollectionT1534 Internal Spearphishing
- Tags
- eviltokensphishing-as-a-servicedevice-code-phishingoauthmicrosoft-365business-email-compromisetakedown
- Vendors
- Microsoft
- Products
- Microsoft 365Entra ID
- Threat actors
- EvilTokens
From the original article
2 min read at csoonline.com
Microsoft has hailed its success in disrupting EvilTokens, an AI-powered a phishing-as-a-service (PhaaS) platform linked to more than 12,000 compromised Microsoft 365 inboxes across more than 10,000 organizations worldwide. Since February 2026, EvilTokens has offered a subscription platform combining account compromise, mailbox analysis, target selection, and fraud preparation.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.