Microsoft disrupts EvilTokens phishing service linked to 12,000 compromised inboxes

Microsoft says its Digital Crimes Unit coordinated a Sept. 22 disruption of EvilTokens, an AI-assisted phishing service the company says had been linked to more than 12,000 compromised email inboxes at over 10,000 organizations. Microsoft says the service launched in February and paired device-code phishing with tools for analyzing compromised mailboxes and identifying higher-value targets. The operation disrupted infrastructure, but Microsoft’s account does not establish that every related operation or copy has ended.