Reported by 18 outlets
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
Why this score
- Breadth
- 2.00 / 2.0 · 18 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Microsoft's Digital Crimes Unit and industry partners disrupted EvilTokens on a federal court order executed Sept 15, 2026, seizing the 50 websites the service ran on and disabling more than 175 supporting domains. Microsoft tracks the operator as Storm-2992 and links the platform, active since February 2026 and sold to roughly 1,000 criminal customers, to more than 12,000 compromised Microsoft 365 inboxes across over 10,000 organizations. The mechanism is OAuth 2.0 device code phishing: the victim types an attacker-generated code into Microsoft's genuine devicelogin page and completes real MFA, authorizing the attacker's session, and the kit times code generation to the victim's page load because codes expire within 15 minutes. Captured refresh tokens roll for 90 days and the backend converts them into a Primary Refresh Token for silent single sign-on across the tenant's apps.
The takedown closed a seven-month operation that public reporting had already mapped in full: Sekoia identified the service on Telegram on March 3 and published its analysis March 30, Unit 42 recorded the earliest observed page on Feb 18, and Huntress measured a 16-day wave from March 2 hitting 344 organizations in five countries, with device-code indicators in 87.4% of cases. MFA never failed and no password was stolen, which is why the lures passed Cisco, Trend Micro and Mimecast with clean URLs; perimeter telemetry had nothing to catch. The differentiator was automation after capture: a pipeline that pulled inbox rules, contacts and calendars over Graph, ingested up to 5,000 emails through Groq-hosted llama-3.1-8b-instant, and drafted thread-hijacking BEC replies with llama-3.3-70b-versatile in minutes. The implication the event list does not spell out: seizing 50 sites evicts no one, because every one of those 12,000 mailboxes was taken with tokens that survive password resets and keep renewing for 90 days, so the victim pool stays exposed for months after the press release.
Treat this as an identity incident, not a phishing one. Block the device code flow via Conditional Access wherever no printer, Teams Room or conferencing hardware needs it, and for any user phished since February revoke sessions and refresh tokens rather than resetting passwords alone. Hunt in Entra sign-in logs for AuthenticationProtocol == "deviceCode", alert on first-time device code use per user (Paul Newton's hunt-2025-043 pattern: 30-day lookback, successful sign-ins only), on new device registrations, and on covert inbox rules; Microsoft's Sept 22 threat intelligence post ships matching Defender XDR detections and hunting queries. Sweep mail gateway and proxy telemetry for Sekoia's markers: the X-Antibot-Token HTTP header, requests to /api/device/start, and workers.dev hostnames shaped like docusign-xxx or onedrive-xxx with a "-s-account" suffix; the YARA rule phishing_eviltokens_phishing_page catches the pages themselves, and phishing-resistant FIDO2 or passkeys closes the technique.
Two developments would change this assessment. First, residual infrastructure: Sekoia counted over 1,000 EvilTokens domains while Microsoft disabled about 175, and Talos has already documented an affiliate panel, ARToken, exposing 80+ API endpoints with shared contracts, so watch for kit rebrands, the operator's promised Gmail and Okta phishing pages, and fresh Railway or Cloudflare Workers deployments. Second, dispersal: roughly 1,000 affiliates trained on automated BEC did not stop existing on Sept 15, and their migration into other PhaaS ecosystems would turn a successful disruption into a diffusion problem.
Timeline
-
update from newtonpaul.com
Uncovering a New Device Code Phishing Campaign
newtonpaul.com · 218d ago · March 10th, 2026
Independent researcher Paul Newton documented a phishing campaign abusing Microsoft device code authentication through Cloudflare workers.dev domains whose subdomains embed the victim's email address, with a '/api/device/start' + X-Antibot-Token page flow that auto-copies the code and redirects to adobe.com after token capture. The post published KQL hunting queries, including 'SigninLogs | where AuthenticationProtocol == "deviceCode"' and a first-time device code auth hunt (hunt-2025-043) with a 30-day lookback filtered to ResultType == 0, plus sender domains registered between 1995 and 2017.
-
update from github.com
Device Code-based OAuth Phishing
github.com · 205d ago · March 23rd, 2026
Unit 42's timely threat intel note, dated March 23, 2026, tracked an active device code phishing campaign impersonating a cloud file storage service and two e-signature platforms, with its earliest observation on Feb 18, 2026. It detailed AES-GCM encrypted payloads delivered via Cloudflare Workers, cookie exfiltration, anti-analysis tricks such as debugger traps and DevTools detection, and listed workers.dev indicators overlapping Sekoia's EvilTokens set, including index-ap3.tyler2miler-proton-me-s-account.workers.dev.
-
update from sekoia.com
New widespread EvilTokens kit: device code phishing as-a-service - Part 1
sekoia.com · 198d ago · March 30th, 2026
Sekoia's TDR team published the first public technical analysis of the EvilTokens kit on March 30, 2026, after privately distributing it as FLINT report 2025-038 on March 25, having first identified the service in phishing-focused criminal communities on March 3, 2026, with pages circulating since mid-February. The analysis documents the backend REST API (api/device/start, api/prt/convert, api/prt/cookie generating the x-ms-RefreshTokenCredential cookie for browser SSO hijack), rolling 90-day refresh tokens and Primary Refresh Token conversion, 66 phishing attachments collected by March 19, over 1,000 urlscan hits by March 23, the distinctive X-Antibot-Token header, Cloudflare Workers domain naming patterns, and a YARA rule (creation date 2026-03-05).
-
update from sekoia.com
EvilTokens: an AI-augmented Phishing-as-a-Service for automating BEC fraud - Part 2
sekoia.com · 190d ago · April 7th, 2026
Part 2, published April 7, 2026, details the Telegram-based operation run by eviltokensadmin since Feb 17, 2026: the $1,500 Office 365 capture link with lifetime panel access plus a $500 monthly licence, a ~280-subscriber private group as of March 19, and NOWPayments crypto billing. It maps the AI fraud pipeline: Graph API reconnaissance of inbox rules, contacts, calendars and sent items, ingestion of up to 5,000 stolen emails in batches of 250 through the Groq API using llama-3.1-8b-instant, BEC scenario drafting with llama-3.3-70b-versatile, gpt-4o-mini for translation, and a $500 Portal Browser for operating stolen sessions.
-
update from huntress.com
How EvilTokens Turbocharges Old School Phishing with AI
huntress.com · 156d ago · May 11th, 2026
Huntress's May 11, 2026 writeup reconstructs the campaign telemetry behind its earlier 344-organization, five-country, 16-day wave: first alerts on Feb 19 and Feb 24, escalation on March 2, one cloud IP hitting 50 organizations in a single week, and relaying through the Railway.com PaaS. It notes the lures passed Cisco Secure Email, Trend Micro and Mimecast untouched, and that Huntress pushed a conditional access policy blocking Railway infrastructure across more than 60,000 tenants.
-
update from flare.io
What is EvilTokens?: The PhaaS Platform That Tells Attackers What to Do After They Get In
flare.io · 51d ago · August 24th, 2026
Flare's Emerging Threats researcher Assaf Morag profiled EvilTokens on Aug 24, 2026, one day before the takedown coverage cycle, tying together the $1,500 plus $500-per-month pricing, the 16-day 344-organization wave, and Sekoia's infrastructure findings of 66 lure attachments and 1,000+ related infrastructure results. The post frames the platform's significance as the commoditization of post-compromise work: inbox analysis, stakeholder mapping and AI-generated fraud messages sold as features rather than skills.
-
update from gbhackers.com
EvilTokens Abuses Microsoft Device Codes to Hijack Accounts Without Stealing Passwords
gbhackers.com · 49d ago · August 25th, 2026
EvilTokens is pushing phishing-as-a-service beyond credential theft by abusing Microsoft’s device authorization flow to obtain valid Microsoft 365 tokens. Victims can complete a legitimate Microsoft sign-in and MFA challenge, yet unknowingly authorize an attacker-controlled session. The PhaaS operation was advertised on Telegram from mid-February 2026 and was later documented by Sekoia researchers as a turnkey […] The post EvilTokens Abuses Microsoft Device Codes to Hijack Accounts Without Stealing Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
AI-Powered EvilTokens Turns Hijacked Microsoft Accounts Into Financial Fraud
cyberpress.org · 49d ago · August 25th, 2026
Instead of stopping after token theft, it helps cybercriminals analyze compromised inboxes, identify high-value payment conversations, and create convincing fraud messages with AI. Its Microsoft-focused Office 365 capture service reportedly cost $1,500 for panel access, followed by a $500 monthly fee to keep phishing links and backend services active. Researchers have linked the operation to a 16-day campaign affecting 344 organizations in five countries. Unlike older phishing kits, EvilTokens offers a complete post-compromise playbook. Attackers can capture access tokens, search email content, find suppliers and payment approvers, and prepare business email compromise (BEC) messages. This turns a single hijacked identity into an opportunity for invoice fraud, payment redirection, and targeted scams. This sign-in method is designed for devices that cannot easily display a normal browser-based login page. The attack begins with a phishing lure that directs a target to an EvilTokens-controlled page. The victim enters the code and completes the
-
update from cyberscoop.com
Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud
cyberscoop.com · 21d ago · September 22nd, 2026
Microsoft, along with a group of industry partners, disrupted EvilTokens, a short-lived but highly consequential cybercrime platform that investigators linked to more than 12,000 compromised Microsoft customer email inboxes across more than 10,000 organizations globally, the company said Tuesday. Acting on federal court order Sept. 15, Microsoft and partners seized 50 websites the phishing-as-a-service used for operations and disabled more than 175 domains linked to EvilTokens’ supporting infrastructure. EvilTokens, launched in February 2026, was “a powerful cybercrime platform that used AI at every step of the attack chain — from compromising email accounts to designing intricate roadmaps for financial fraud and scams,” Steven Masada, associate general counsel and general manager of Microsoft’s Digital Crimes Unit, wrote in a blog post . About 1,000 cybercriminals used EvilTokens over the course of its operation, a Microsoft spokesperson told CyberScoop. The service was centered on an AI-style chatbot that cybercriminals used to analyze victims’ inboxes, identify trusted relationships, payment authorizations and other sensitive details that could facilitate fraud. “AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible,” Masada wrote.
-
update from microsoft.com
Unmasking EvilTokens: Getting to the root of device code phishing
microsoft.com · 21d ago · September 22nd, 2026
In this article What is device code phishing? EvilTokens platform and operations EvilTokens phishing emails Mitigation and protection guidance Microsoft Defender XDR detections Hunting queries Following its emergence in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, providing cybercriminals with AI capabilities for tailoring phishing lures and analyzing compromised inboxes to identify high-value targets. EvilTokens enabled threat actors to abuse the device code authentication flow, steal tokens, and compromise organizational accounts at scale using an AI-driven infrastructure and automating multiple parts of the attack chain. The toolkit offered a plethora of prebuilt phishing templates and landing pages with an AI-powered assistant to aid in structuring target-specific emails. Stolen tokens are used for email exfiltration and persistence, often through the creation of malicious inbox rules that conceal communications. In some cases, tokens can also be used to grant new devices access to a victim’s inbox, a particularly durable method to maintain persistence. Microsoft Threat Intelligence tracks the threat actor behind the development and support of the EvilTokens phish kit as Storm-2992.
-
mentioned by www.bleepingcomputer.com
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts https:// bleepingcomputer.com/news/security/ eviltokens-phaas-disrup
www.bleepingcomputer.com · 21d ago · September 22nd, 2026
-
mentioned by malware.news
Unmasking EvilTokens: Getting to the root of device code phishing
malware.news · 21d ago · September 22nd, 2026
-
mentioned by blogs.microsoft.com
Microsoft disrupted EvilTokens! https:// blogs.microsoft.com/on-the-issues/ 2026/09/22/disrupting-eviltokens-the-ai-chatbot-built-for-cyberc
blogs.microsoft.com · 21d ago · September 22nd, 2026
-
update from cyberpress.org
EvilTokens Phishing Service Uses AI and Device Code Attacks to Hijack Microsoft Accounts
cyberpress.org · 20d ago · September 23rd, 2026
EvilTokens emerged in February 2026 and quickly gave cybercriminals a ready-made platform for large-scale business email compromise attacks. The platform reportedly offered dozens of phishing themes, including fake invoices, shared documents, request-for-proposal messages, password-expiration alerts, voicemail notices, and cloud-service notifications. Operators could customize pages, redirect victims through multiple sites, use CAPTCHA-style checks , and track targets after they interacted with a lure. A key feature was an AI assistant that helped criminals tailor phishing emails to a target’s role. Once an inbox was compromised, the same capability could review email activity, locate high-value employees, and identify information useful for fraud, such as invoices, wire-transfer discussions, executive correspondence, and vendor relationships. The technique abuses a legitimate OAuth device-code sign-in process intended for devices with limited input options, such as smart TVs, printers, Teams devices, and conferencing equipment. EvilTokens Telegram stor
-
mentioned by blogs.microsoft.com
Look, Evilginx has an AI successor. # infosec
blogs.microsoft.com · 20d ago · September 23rd, 2026
-
mentioned by gbhackers.com
Microsoft Warns of EvilTokens AI Phishing Service Hijacking Thousands of Accounts
gbhackers.com · 20d ago · September 23rd, 2026
-
update from securityweek.com
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
securityweek.com · 20d ago · September 23rd, 2026
The authentication process requires the user to enter a short code presented on the device into a web browser session on a separate device. Advertisement. Scroll to contin
-
update from theperimetersite.com
12,000. That's how many email accounts were hit by the EvilTokens phishing platform before Microsoft finally killed it. https:// theperimete
theperimetersite.com · 20d ago · September 23rd, 2026
That's how many email accounts were hit by the EvilTokens phishing platform before Microsoft finally killed it. https:// theperimete
via Mastodon https://theperimetersite.com/report/295
-
update from justpaste.in
ID verification giant IDScan confirms data breach with more than 150 million driver’s licenses stolen The ID checking company said the data
justpaste.in · 20d ago · September 23rd, 2026
ID verification giant IDScan confirms data breach with more than 150 million driver’s licenses stolen The ID checking company said the data
via Mastodon https://justpaste.in/news/id-verification-giant-idscan-confirms-data-breach-with-more-than-150-million-drivers-licenses-stolen/
-
mentioned by www.bleepingcomputer.com
# EvilTokens # PhaaS disrupted after compromising 12,000 # Microsoft accounts https://www. bleepingcomputer.com/news/secu rity/eviltokens-ph
www.bleepingcomputer.com · 20d ago · September 23rd, 2026
-
update from meterpreter.org
Microsoft dismantled the EvilTokens phishing platform, an AI-powered service that hijacked 12,000+ mailboxes via OAuth Device Code Flow abus
meterpreter.org · 19d ago · September 24th, 2026
Microsoft dismantled the EvilTokens phishing platform, an AI-powered service that hijacked 12,000+ mailboxes via OAuth Device Code Flow abus
via Mastodon https://meterpreter.org/eviltokens-phaas-takedown/?utm_source=mastodon&utm_medium=jetpack_social
-
mentioned by insicurezzadigitale.com
EvilTokens: [REDACTED] unmasks device code phishing service behind 12,000 compromised mailboxes
insicurezzadigitale.com · 18d ago · September 25th, 2026
-
update from insicurezzadigitale.com
EvilTokens: [REDACTED] exposes the phishing-as-a-service behind 12,000 compromised mailboxes with device code phishing
insicurezzadigitale.com · 18d ago · September 25th, 2026
EvilTokens: [REDACTED] exposes the phishing-as-a-service operation behind 12,000 compromised mailboxes, built on device code phishing # CyberSecurity
via Mastodon https://insicurezzadigitale.com/eviltokens-microsoft-smaschera-il-phishing-as-a-service-da-12-000-caselle-violate-con-il-device-code-phishing/
-
mentioned by thehackernews.com
Microsoft took down EvilTokens, a phishing service using AI at every attack step, with court approval. Partners included Cloudflare, Coinbas
thehackernews.com · 15d ago · September 29th, 2026