Skip to content
NewA calmer, faster ZeroHour
StoryPhishing & fraudhighExploited in the wild

Microsoft and Partners Disrupt EvilTokens, AI-Powered Phishing Service That Compromised 12,000+ Inboxes

2 sources · 2 articlesFirst reported Updated ()2 · 1 read
What's new

The EvilTokens PhaaS operation, which had compromised 12,000+ inboxes at 10,000+ organizations, was disrupted/taken down by Microsoft, Coinbase, and law enforcement: 50 websites were seized, over 175 domains were disabled, and arrest(s) were made in the UK.

Merged summary · glm-5.3 · rewritten as coverage arrivesSummaries by Vani AI

EvilTokens, an AI-powered phishing-as-a-service kit run by Storm-2992 that used device-code phishing to bypass MFA and compromise 12,000+ inboxes at 10,000+ organizations, has been disrupted by Microsoft, Coinbase, and law enforcement, with arrest(s) in the…

EvilTokens was a phishing-as-a-service (PhaaS) kit operated by Storm-2992 that compromised more than 12,000 inboxes/email accounts across over 10,000 organizations by exploiting Microsoft's device-code sign-in flow. Victims entered codes on legitimate Microsoft sign-in pages, allowing the kit to bypass MFA. AI was used to draft targeted lures, map organizational structures, and automate post-compromise reconnaissance for business email compromise (BEC) and payment fraud; once access was gained, attackers registered new devices and created hidden inbox rules for persistence and evasion. The service was offered for a $1,500 initial fee plus a $500 monthly subscription. On 2026-09-23, Microsoft, Coinbase, and law enforcement announced the takedown: 50 websites were seized, over 175 domains were disabled, and Coinbase traced $1.1 million in cryptocurrency payments to the operation. Partners supporting the action included SpyCloud, Coinbase, and OpenAI. Reports disagree on arrests: Security Affairs reports an arrest by London's Metropolitan Police, while SecurityWeek reports two suspects were arrested in the UK.

Key facts
  • EvilTokens was a phishing-as-a-service (PhaaS) kit operated by Storm-2992.
  • It compromised over 12,000 inboxes/email accounts at more than 10,000 organizations.
  • The kit used device-code phishing against Microsoft's sign-in flow to bypass MFA, with victims entering codes on legitimate Microsoft sign-in pages.
  • AI features were used to draft targeted lures, map organizational structures, and automate post-compromise reconnaissance for BEC and payment fraud.
  • Attackers maintained persistence by registering new devices and creating hidden inbox rules.
  • The service charged a $1,500 initial fee and a $500 monthly subscription.
  • The takedown involved seizing 50 websites and disabling over 175 domains.
  • Coinbase traced $1.1 million in cryptocurrency payments linked to the operation.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
MicrosoftCoinbaseGallup404 Media
Products
Microsoft Entra IDTronAlways On VPNSSTPIKEv2Entra IDWindows 10Windows 11Windows Server
Threat actors
Storm-2992Felix UtomiWaidi Segun Adams
Malware
EvilTokens
Victims
10,000+ organizations
Organizations
MicrosoftCoinbaseCloudflareHealth-ISACOpenAIRailwaySpyCloudShadowserverLondon Metropolitan PoliceTRM LabsThe Shadowserver Foundation
Countries
CanadaFranceIndiaUKUSAustralia
AI models
EvilTokens

Coverage

oldest first · one row per article · UTC
  1. · Sep 23, 2026 Cyber Security NewsFirst report

    The Phishing Kit That Turned Microsoft’s Login Flow Into an AI-Powered Fraud Machine

    EvilTokens PhaaS kit uses AI and device-code phishing to bypass MFA, compromising 12,000+ corporate inboxes for payment fraud.

  2. · Sep 23, 2026 Security Affairs

    EvilTokens made phishing-as-a-service look easy. Then it got taken down

    Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.