EvilTokens made phishing-as-a-service look easy. Then it got taken down
Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.
Microsoft, Coinbase, and law enforcement have taken down EvilTokens, a phishing-as-a-service (PhaaS) kit operated by Storm-2992 that compromised over 12,000 inboxes across 10,000 organizations. The kit used device-code phishing to bypass MFA and AI-powered tools for post-compromise reconnaissance and payment fraud. Coinbase traced $1.1 million in cryptocurrency payments, leading to an arrest by London's Metropolitan Police. The takedown involved seizing 50 websites and disabling over 175 domains.
- EvilTokens was a phishing-as-a-service (PhaaS) kit that compromised 12,000+ inboxes.
- It used device-code phishing and AI-powered post-compromise automation.
- Microsoft, Coinbase, and law enforcement took down the operation and arrested the operator.
- The kit bypassed MFA by having victims enter codes on legitimate Microsoft sign-in pages.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1539 Steal Web Session CookieT1078 Valid AccountsT1562.001 Disable or Modify ToolsT1114.002 Remote Email Collection
- Tags
- business-email-compromisedevice-code-phishingevil-tokensmfa-bypassphishingphishing-as-a-servicestorm-2992takedown
- Products
- Microsoft Entra IDTron
- Threat actors
- Storm-2992
- Malware
- EvilTokens
From the original article
4 min read at securityaffairs.com
Microsoft, Coinbase and law enforcement took down EvilTokens, a phishing kit that compromised 12,000 inboxes through device-code phishing and AI. EvilTokens showed up in February 2026 and moved fast. Within months it had compromised more than 12,000 inboxes across over 10,000 organizations.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.