On September 22, Microsoft’s Digital Crimes Unit announced the disruption of EvilTokens, which it describes as an end-to-end, AI-enabled cybercrime service. It was a phishing-as-a-service platform: criminals paid for access, and the platform handled account compromise, mailbox analysis, target selection and fraud preparation. It matters because the core attack, tricking people into authorising a sign-in, works without stealing a password.
How it worked
- Access without a password. Victims were tricked into entering an authentication code on Microsoft’s legitimate sign-in page. Because they completed the real sign-in, attackers got into their email without ever seeing a password. Microsoft notes that device-code attacks are involved.
- Persistence. Access could continue after a password reset if the associated sessions and tokens were not also revoked.
- AI-assisted targeting. A chatbot-style tool summarised and translated emails, surfaced finance conversations, mapped roles, and recommended who to impersonate. Preset prompts looked for wire-transfer discussions, “money movers” and vendor invoices.
- Sold as a service. Distribution was through Telegram, with a $1,500 initiation fee and a $500 recurring subscription, plus support and management dashboards.
- Built with AI. Investigators found large parts were “vibe coded” with AI assistance and drew on multiple AI models.
The numbers
- Launched in February 2026.
- Linked to more than 12,000 compromised inboxes across more than 10,000 organisations within months.
- Highest victim activity in the United States, Canada, the United Kingdom, Australia, India and France.
- Sectors hit included wholesale distribution, construction, financial services, real estate, higher education and healthcare.
- Microsoft seized 50 websites and disabled more than 150 supporting domains.
The response
Microsoft acted under a civil case authorised by the U.S. District Court for the Eastern District of Virginia, with Health-ISAC as co-plaintiff because healthcare was targeted. Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs acted against parts of the platform. In the UK, the Metropolitan Police cybercrime team arrested two men, aged 32 and 38, on September 11 and seized devices. Both were released on bail with conditions while the investigation continues. Microsoft calls this its 40th court-authorised disruption and its first against an end-to-end AI-enabled cybercrime service.
Where to be skeptical
- The figures are Microsoft’s. The victim counts come from its own investigation and have not been independently verified here.
- The technique is not new. Device-code phishing and business email compromise predate this tool. The AI layer speeds up triage and message writing; it does not change the underlying weakness.
- A takedown is not the end of the method. The same attack can be run with other tools, and the arrests are not convictions.
What to do
- Restrict the device code flow. If your users do not need it, use Microsoft Entra Conditional Access to limit it. Microsoft links its threat intelligence guidance on device-code attacks from its announcement.
- Revoke sessions and tokens, not just passwords, after any suspected account compromise.
- Train users on one rule: do not enter a code you did not personally request, even on a real Microsoft page.
- Verify money requests out of band. Confirm payment-detail changes, fund redirects and unusual approvals through a trusted second channel such as a phone call to a known number.
- Review sign-in logs for device-code authentications and unfamiliar mailbox activity, especially for finance and executive accounts.
Microsoft’s advice is to assume a compromised inbox can be understood by criminals within minutes, so speed of detection matters more than a clean clean-up afterwards.
