/tech

Microsoft disrupts EvilTokens phishing service linked to 12,000 compromised inboxes

Microsoft says the AI-assisted service used device-code phishing and was linked to more than 10,000 organizations worldwide.

4 Sources, ,

TLDR

Microsoft says its Digital Crimes Unit coordinated a Sept. 22 disruption of EvilTokens, an AI-assisted phishing service the company says had been linked to more than 12,000 compromised email inboxes at over 10,000 organizations. Microsoft says the service launched in February and paired device-code phishing with tools for analyzing compromised mailboxes and identifying higher-value targets. The operation disrupted infrastructure, but Microsoft’s account does not establish that every related operation or copy has ended.

Featured Source

Microsoft says it has coordinated a disruption of EvilTokens, an AI-assisted phishing service that the company says was linked to more than 12,000 compromised email inboxes at over 10,000 organizations worldwide.

The company’s Digital Crimes Unit announced the operation on Sept. 22. In its account of the disruption, Microsoft said EvilTokens launched in February 2026 and quickly became a service for phishing campaigns. The company’s figures describe activity linked to the platform; they are not an independent count of every compromise.

How the service was used

Microsoft says EvilTokens combined device-code phishing with tools that could help an attacker work through a compromised mailbox. Device-code flows are legitimate sign-in mechanisms for devices with limited input, but a phishing operation can try to persuade a victim to enter a code or authorize a session controlled by someone else.

Once access was obtained, BleepingComputer reported that the service used Microsoft Graph to map organizational relationships, analyze mailbox content and identify higher-value targets. Microsoft’s separate security analysis describes the same device-code phishing pattern and says the Digital Crimes Unit worked with partners on the infrastructure action.

The action is a disruption, not a guarantee that phishing using similar methods has disappeared. For organizations and users, the immediate practical lesson is to treat unsolicited device-code prompts as carefully as other credential requests, verify where a sign-in flow originated and review any unfamiliar authorization activity.

TLDR

How the service was used

Microsoft disrupts EvilTokens phishing service linked to 12,000 compromised inboxes

TLDR

How the service was used

Microsoft disrupts EvilTokens phishing service linked to 12,000 compromised inboxes

4 Sources

Combined views

How the service was used

Combined views

Sentiment

Summary

TLDR

How the service was used

Sentiment

Summary

Sentiment

Summary

4 Sources