Microsoft Disrupts EvilTokens Phishing Platform
Microsoft announced on Tuesday that it disrupted EvilTokens, an AI-powered phishing platform used by cybercriminals to target organizations around the world. The operation represents one of the most significant takedowns of a phishing-as-a-service operation that combined generative AI, device code authentication abuse, and subscription-based criminal access. According to Microsoft, EvilTokens emerged in February 2026 and quickly became a tool for compromising email accounts at scale. The platform was used to compromise more than 12,000 email accounts at over 10,000 organizations, with victims in the United States, Canada, the United Kingdom, Australia, India, and France.
The service was designed to make credential theft unnecessary. Instead of stealing passwords, EvilTokens exploited the device code authentication flow, a legitimate mechanism intended for devices that cannot easily support standard login methods. Televisions, printers, and other limited-input devices often rely on this flow. A user is shown a short code on one device and is asked to enter it in a browser session on a separate device. Once the code is entered and the authentication is approved, the device receives an access token. Threat actors can abuse this process by starting the authentication flow themselves and then sending the code to a targeted user through a phishing lure. If the user completes the process using the attacker's code, the attacker receives an access token without ever knowing the victim's password.
How Device Code Phishing Works
Device code phishing is attractive to attackers because it bypasses many traditional credential theft defenses. Multi-factor authentication may not stop the attack if the victim is the one who approves the authentication attempt. The attacker does not need to trick the victim into typing a password into a fake page. Instead, the victim is asked to visit a legitimate authentication page and enter a code. Because the page is genuine, security awareness training that focuses on suspicious URLs and fake login forms may not be enough.
EvilTokens specialized in this technique. It made it easier for cybercriminals to obtain access tokens that provided persistent access to email accounts. Once a token was issued, the attacker could use it to read messages, send emails, download attachments, and monitor communications. The token could also allow the attacker to remain in the account even after the victim changed their password, depending on the token lifetime and the configuration of the environment. That persistence is one reason email account takeover is so valuable to criminal groups.
The platform did not rely on a single attack step. It automated parts of the process, from generating the initial lure to managing the authentication flow and then using the resulting access. This lowered the technical barrier for criminals who wanted to run sophisticated phishing campaigns. Instead of building their own infrastructure and writing their own scripts, they could pay for access to a service that handled much of the work.
AI Across the Attack Chain
EvilTokens used artificial intelligence throughout the attack chain. AI helped create phishing emails customized for specific targets, increasing the chances that a recipient would engage with the message. The platform offered 44 different themes for malicious emails and phishing pages, allowing attackers to match their lures to different industries, brands, or workplace scenarios. These themes could make a message look like a routine IT request, a document sharing notification, a payroll update, or another familiar business communication.
AI also helped after access was gained. According to Microsoft, the platform's AI capabilities helped users go through victims' inboxes for valuable data. It helped them decide who to target, who to impersonate, and how to most effectively exploit relationships to extract as much money as possible. That kind of analysis can turn a single compromised mailbox into a broader business email compromise campaign. An attacker can study ongoing conversations, identify financial approvals, learn who has authority to authorize payments, and craft replies that appear to come from a trusted colleague or executive.
Microsoft believes the platform itself was also coded using AI. If accurate, that detail highlights how AI is changing the economics of cybercrime. AI can help developers write code faster, generate user interfaces, create documentation, and even troubleshoot issues. Criminal service operators can use the same tools to build and maintain their platforms. The result is a faster development cycle and a lower skill threshold for running advanced phishing operations.
Subscription Pricing and Global Reach
To access and use EvilTokens, cybercriminals had to pay $1,500 for initial access and a $500 monthly fee. That pricing model is consistent with the phishing-as-a-service economy, where criminal tools are sold or rented to other criminals. The subscription model gives operators recurring revenue and gives users ongoing updates, new themes, and support. It also means that the platform can serve many unrelated criminal groups at once, increasing the total number of victims.
The scale described by Microsoft is substantial. More than 12,000 email accounts were compromised at over 10,000 organizations. The victims were spread across multiple countries, including the United States, Canada, the United Kingdom, Australia, India, and France. That geographic spread shows how cloud-based authentication and email services can be targeted regardless of where the attacker or the victim is located. A criminal can operate from one region, target an organization in another, and use infrastructure hosted in multiple jurisdictions.
Organizations of all sizes can be affected by email account takeover. Large enterprises may have more valuable data and more complex financial processes, but small and medium-sized businesses are often less prepared to detect anomalous authentication activity. Schools, healthcare providers, government agencies, and nonprofits are also attractive targets because they hold sensitive information and may have limited security resources. The stolen access can be used for fraud, data theft, malware distribution, or further intrusions into connected systems.
Takedown and Arrests
Microsoft seized 50 websites used to run the EvilTokens service and disabled more than 150 other domains linked to the platform's infrastructure. The technical disruption is significant because it removes the websites and domains that customers relied on to access the platform. However, phishing-as-a-service operations can sometimes rebuild or move to new infrastructure. The arrests and legal actions are therefore important parts of the response.
In addition to the technical disruption, Microsoft announced that two men suspected of being linked to the operation of EvilTokens were arrested in the United Kingdom. They were identified as Felix Utomi and Waidi Segun Adams. Microsoft named the suspects in a complaint filed as part of its efforts against the phishing platform. The complaint also targets five unnamed individuals. The arrests suggest that law enforcement and private companies are trying to pursue not only the infrastructure but also the people allegedly behind the service.
Legal complaints in these cases can serve several purposes. They can support seizure orders, formalize evidence, and create pressure on suspects. They can also help coordinate action across jurisdictions. Because cybercrime platforms often rely on domains, hosting providers, payment processors, and other third-party services, legal pressure can be applied at multiple points in the criminal supply chain. The involvement of payment companies and blockchain analysis firms is especially relevant when criminal services accept cryptocurrency.
Industry Collaboration Behind the Takedown
SpyCloud, TRM Labs, Coinbase, Health-ISAC, Cloudflare, OpenAI, Railway, and The Shadowserver Foundation also contributed to the EvilTokens takedown. That list reflects the broad coalition needed to disrupt a modern phishing platform. Cybersecurity firms can provide threat intelligence and identify infrastructure. Blockchain analysis and cryptocurrency exchanges can help trace payments and identify financial links. Industry information-sharing groups can help warn affected sectors. Cloud and hosting providers can act on abuse reports. AI companies can help understand how their models may be abused and improve safeguards. Research and notification organizations can help alert victims and clean up infrastructure.
The collaboration also shows that phishing is not only a technical problem for individual victims. It is an ecosystem problem that involves domain registrars, hosting companies, payment networks, email providers, and identity platforms. Disrupting one platform requires coordination across many of those layers. Even then, the criminal market may adapt. New services can emerge, and existing operators may rebrand or shift to new techniques. That reality makes continuous monitoring and information sharing essential.
Why Email Account Takeover Remains So Dangerous
Email accounts are often the master key to an organization's digital life. They are used for password resets, security alerts, document sharing, financial approvals, and internal communications. When an attacker controls a mailbox, they can search for sensitive information, impersonate the owner, and send messages that appear legitimate. They can also use the account to phish other employees or external partners. Because the messages come from a trusted address, recipients may be far more likely to click links or follow instructions.
Business email compromise is one of the most financially damaging forms of cybercrime. Attackers often wait for the right moment, such as an invoice payment, a real estate closing, or a payroll change. They may insert themselves into an existing email thread, reply to a message, and provide new bank account details. The victim may not realize anything is wrong until the money is gone. Device code phishing makes this kind of access easier because it avoids some of the usual warning signs. There may be no fake login page to report and no stolen password to reset.
Organizations should monitor for unusual token issuance and authentication patterns. Sign-ins from unfamiliar locations, new device registrations, and access to mailboxes from unexpected applications can all be indicators of compromise. Conditional access policies can restrict device code flow where it is not needed. Administrators can require compliant devices, trusted locations, or stronger authentication for sensitive accounts. User education should also cover device code phishing, because the victim is asked to approve a legitimate-looking authentication request rather than enter credentials into a suspicious site.
The AI Phishing Threat Continues to Evolve
EvilTokens is part of a broader trend in which AI is used to make phishing more convincing and more scalable. AI can generate fluent text, translate messages, mimic writing styles, and create variations for different targets. It can also help attackers analyze large amounts of data after they gain access. The combination of automation and generative AI means that criminal groups can run campaigns that would previously have required significant manual effort.
At the same time, AI is being used by defenders. Security teams can use AI to detect anomalous behavior, summarize threat intelligence, and prioritize alerts. Email providers can use machine learning to identify suspicious messages and authentication patterns. The contest between attackers and defenders is increasingly a contest over data, speed, and scale. Platforms like EvilTokens show how quickly criminal services can adopt new capabilities and how important it is for defenders to collaborate across industry and borders.
Microsoft's action against EvilTokens does not eliminate device code phishing or AI-powered phishing. It does, however, remove a major service that many criminals relied on. The seized websites, disabled domains, and arrests may force some users to find alternatives, at least temporarily. The case also provides valuable insight into how these platforms operate and how they combine legitimate authentication mechanisms with AI-driven targeting. As investigations continue, the complaint targets five unnamed individuals, suggesting that the legal and operational pressure may extend beyond the two arrests already announced.
Source: SecurityWeek News