Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes
Microsoft and partners seized EvilTokens infrastructure after the phishing service compromised over 12,000 inboxes.
Microsoft, with court authorization and partners including Health-ISAC, Cloudflare, Coinbase, and OpenAI, disrupted the EvilTokens phishing service, which compromised more than 12,000 inboxes at over 10,000 organizations. Victims entered an authentication code on Microsoft's legitimate sign-in page, granting persistent token access that could survive a password reset. The service's AI tools summarized and translated mail, identified payment contacts, and drafted impersonation messages. It sold on Telegram for a $1,500 fee plus $500 recurring. On September 11, 2026, London police arrested two men, and Microsoft seized 50 sites and disabled more than 150 domains.
- EvilTokens compromised more than 12,000 inboxes at over 10,000 organizations.
- Victims entered codes on Microsoft's real sign-in page, exposing tokens without passwords.
- An AI chatbot summarized mail, mapped roles, and drafted impersonation messages.
- Partners seized 50 websites and disabled more than 150 related domains.
- UK police arrested two men, ages 32 and 38, who were later bailed.
- ATT&CK
- T1566 PhishingT1528 Steal Application Access TokenT1114.002 Remote Email CollectionT1534 Internal Spearphishing
- Vendors
- Microsoft
- Products
- Microsoft 365
- Threat actors
- EvilTokens
From the original article
2 min read at helpnetsecurity.com
The EvilTokens phishing service, which compromised more than 12,000 inboxes at over 10,000 organizations, has been disrupted by a coalition of law enforcement and private-sector partners led by Microsoft.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.