Microsoft announced action against the EvilTokens phishing service on September 22, 2026. The company says the operation used AI-assisted social engineering and abused legitimate sign-in processes to compromise organisational accounts.
In its technical report, Microsoft links the service to more than 12,000 compromised inboxes across over 10,000 organisations. Those figures describe Microsoft’s observed activity, rather than an independently audited total.
Why a genuine sign-in page can still be dangerous
Device-code authentication is designed for devices with limited input capabilities. In this attack, a victim is persuaded to enter a code that authorizes a session initiated by the attacker. The sign-in page itself can be legitimate, and completing multifactor authentication does not establish that the session belongs to the intended device.
Response extends beyond the takedown
Microsoft’s disruption announcement describes collaboration with Health-ISAC and law enforcement. Disrupting infrastructure does not itself remediate every previously compromised account.
The company advises administrators to restrict device-code authentication where it is unnecessary, with carefully scoped exceptions for legitimate uses. Its technical report provides detection and response guidance. Employees should treat unsolicited requests to enter sign-in codes as suspicious and report them through their organisation’s established security channel.
Featured image: AI-generated editorial illustration; not a documentary photograph.
