Microsoft Dismantles EvilTokens, an AI-Powered Phishing Service Tied to 12,000 Compromised Inboxes
Microsoft announced it had obtained a court order from the U.S. District Court for the Eastern District of Virginia to disrupt EvilTokens, a phishing-as-a-service platform the company describes as combining account compromise, mailbox analysis, and fraud preparation into a single commercial offering. The service, run by an operator Microsoft tracks as Storm-2992, sold access on a subscription basis, with products ranging from roughly $600 to $1,500 plus recurring monthly fees, and had been active since at least February 2026 when it was first advertised on Telegram.
EvilTokens relied on so-called device-code phishing: victims who clicked malicious links or attachments, disguised behind more than 40 lure themes such as fake invoices or shared-file notifications, triggered automation that generated a live Microsoft device login code and directed them to the legitimate microsoft.com/devicelogin page. Victims who entered the code, along with their credentials and multi-factor authentication response, unknowingly handed attackers a valid access token, which was then used to register rogue devices, plant mailbox rules, and exfiltrate email. Microsoft said the platform also used fake CAPTCHA checks and redirects through trusted hosting services to evade email security filters, and its built-in AI chatbot could analyze victims’ inboxes in more than 20 languages to identify likely fraud targets, map organizational roles, and draft impersonation messages.
According to Microsoft and partner researchers, the platform compromised more than 12,000 email inboxes across upwards of 10,000 organizations globally, with the heaviest concentrations of victims in the United States, Canada, the United Kingdom, Australia, India, and France, spanning sectors including wholesale distribution, construction, financial services, real estate, higher education, and healthcare. Separately, threat intelligence firm SpyCloud identified nearly 8,700 unique compromised accounts across more than 6,500 corporate domains in 79 countries tied to the campaign.
The takedown, coordinated with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, Health-ISAC, the Shadowserver Foundation, and blockchain analytics firm TRM Labs, resulted in the seizure of roughly 50 websites and the disabling of more than 150 associated domains, along with bans on hundreds of Cloudflare Workers projects and domains linked to the operation. London’s Metropolitan Police separately arrested two men, aged 32 and 38, on September 11 in connection with the scheme, and Coinbase said it traced about $1.1 million in cryptocurrency revenue moving through the operator’s wallets between October 2025 and June 2026.