Microsoft-led takedown disrupts EvilTokens, the AI-powered device-code phishing service behind 12,000+ inbox compromises

Microsoft and partners seized EvilTokens infrastructure and UK police arrested two suspects after the Storm-2992 phishing-as-a-service used OAuth device-code phishing and an AI chatbot to compromise 12,000+ inboxes at 10,000+ organizations.

Microsoft's Digital Crimes Unit, acting on an order from the U.S. District Court for the Eastern District of Virginia and with partners including Health-ISAC (a co-plaintiff), Cloudflare, Coinbase, and OpenAI (SecurityWeek also credits SpyCloud), dismantled EvilTokens, a Telegram-marketed phishing-as-a-service platform Microsoft tracks to actor Storm-2992. Active since February 2026, EvilTokens compromised more than 12,000 email inboxes at over 10,000 organizations worldwide, concentrated in the US, Canada, UK, Australia, India, and France per Ars Technica, with GBHackers citing finance, healthcare, and education targets. The kit abused the OAuth 2.0 device-code flow so victims entered codes at Microsoft's legitimate login page, bypassing MFA and handing over session tokens without passwords; access tokens granted persistence that could survive a password reset, via hidden inbox rules and new device registrations, while Microsoft Graph reconnaissance mapped organizations for lateral movement. Delivery used 44 lure themes (invoices, RFPs, shared files) and thousands of short-lived Node.js polling nodes to evade detection. An AI chatbot analyzed compromised inboxes, identified high-value targets and payment contacts, summarized and translated mail, and drafted impersonation emails for business email compromise. Pricing was a $1,500 signup plus $500 per month (The Hacker News reports products ranged from $600 to $1,500 plus the monthly fee); Coinbase traced about $1.1 million in Tron revenue from October 2025 to June 2026 across more than 700 crypto addresses. Microsoft seized 50 websites and disabled more than 150 related domains (Security Affairs puts the figure at over 175). London's Metropolitan Police arrested two suspected administrators, ages 32 and 38, later released on bail; the arrest date is reported as September 11, 2026 by The Hacker News and Help Net Security, but as September 18 by The Register. Microsoft recommends blocking the device code flow where possible and has published Defender detection and hunting guidance plus mail-flow hardening steps.