EvilTokens provided an end-to-end platform that makes mass compromises faster and easier.

EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption of EvilTokens infrastructure and operations.

AIに乗っ取ったメール受信箱を分析させて組織の人間関係や支払いの流れを調べ「誰を狙うべきか」「誰になりすますべきか」「どの関係を悪用すれば金銭詐欺が成功しやすいか」まで提案させるサイバー犯罪サービス「EvilTokens」が展開されていたことをMicrosoftが明らかにしました。

Used by crims to compromise 12K+ email inboxes across 10K+ global orgs

EvilTokens provided an end-to-end platform that makes mass compromises faster and easier.

The EvilTokens platform that compromised more than 12,000 Microsoft accounts at over 10,000 organizations has been disrupted in an effort led by Microsoft's Digital Crimes Unit (DCU).

Microsoft, Health-ISAC, industry partners and law enforcement coordinated legal and operational action to disrupt the EvilTokens cybercrime platform.

Available on Telegram for a $1,500 initiation fee and a recurring monthly $500 subscription, EvilTokens provided cybercriminals with artificial intelligence tools enabling them to compromise accounts,...

Surreptitiously gaining persistent access to compromised Microsoft 365/Entra ID accounts, the group also offered an AI-powered chatbot to facilitate BEC scams.

CYBERSECURITY & PRIVACY · BREAKING ANALYSIS Microsoft Disrupts EvilTokens: How AI-Powered Device-Code Phishing Compromised 12,000+ Inboxes EvilTokens industrialized device-code phishing: victims could authenticate on a real Microsoft page yet still authorize an attacker session. Here is how it worked, what AI added, and the controls Microsoft 365 teams should prioritize. Published September 23, 2026 · Source-based security analysis · No independent forensics claimed…

Microsoft disrupted the EvilTokens phishing platform, which used AI-powered device code phishing to compromise thousands of organizations globally.

EvilTokens provided an end-to-end platform that makes mass compromises faster and easier.

Microsoft and its partners have disrupted EvilTokens, a phishing platform that uses AI throughout the attack chain.

Haz clic para acceder al contenido completo.

¿Qué sucede cuando un ataque utiliza infraestructura oficial en vez de falsificarla? EvilTokens marca una evolución en el phishing: ya no captura credenciales, sino que induce a la…

Microsoft, Health-ISAC, industry partners and law enforcement coordinated legal and operational action to disrupt the EvilTokens cybercrime platform.

It's a 'complete BEC operations environment,' Talos researcher says

EvilTokens provided an end-to-end platform that makes mass compromises faster and easier.

A new malicious kit called EvilTokens integrates device code phishing capabilities, allowing attackers to hijack Microsoft accounts and provide advanced features for business email compromise attacks.