Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft dismantled EvilTokens, an AI-assisted device-code phishing service linked to about 12,000 inbox takeovers.
Microsoft's Digital Crimes Unit, under an order from the U.S. District Court for the Eastern District of Virginia and with partners including Health-ISAC, Cloudflare, Coinbase, and OpenAI, dismantled EvilTokens, a phishing-as-a-service platform tied to about 12,000 inbox compromises. Microsoft tracks the operators as Storm-2992, and the Metropolitan Police Service arrested two men, ages 32 and 38, on September 11, 2026. The kit abused the OAuth 2.0 device-code flow so victims entered codes at Microsoft's real login page, giving attackers access and refresh tokens used for mailbox theft, hidden inbox rules, and business email compromise. Products sold for $600 to $1,500 plus a $500 monthly fee, and Coinbase traced about $1.1 million in Tron revenue from October 2025 to June 2026.
- Court-authorized takedown of the EvilTokens device-code PhaaS.
- Storm-2992 operators; two UK men arrested on September 11, 2026.
- AI chatbot analyzed inboxes and drafted business-email-compromise lures.
- Victims entered device codes at Microsoft's legitimate login page.
- Office 365 kit cost $1,500 plus $500 monthly; about $1.1 million traced.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1528 Steal Application Access TokenT1564.008 Email Hiding RulesT1114 Email Collection
- Products
- Microsoft 365Office 365
- Threat actors
- Storm-2992
- Malware
- EvilTokens
- Organizations
- MicrosoftHealth-ISACCloudflareCoinbaseOpenAIRailwaySpyCloudShadowserver FoundationTRM LabsHuntress
- Countries
- United StatesUnited Kingdom
From the original article
6 min read at thehackernews.com
Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) "at every step of the attack chain." The action, carried out with authorization from the U. S.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.