Microsoft-Led Operation Disrupts EvilTokens Phishing Service That Compromised 12,000 Inboxes

Summary

Microsoft and partners disrupted EvilTokens, a phishing service linked to more than 12,000 compromised inboxes across over 10,000 organizations. Its AI tools analyzed email to help criminals plan fraud; two men were arrested on suspicion of related offenses.

Key points

• Microsoft and partners seized 50 websites and disabled more than 150 domains tied to EvilTokens, with authorization from a US district court.
• The service reportedly compromised more than 12,000 inboxes across over 10,000 organizations.
• Victims were tricked into entering authentication codes on Microsoft’s legitimate sign-in page, giving attackers account access without obtaining passwords.
• AI tools summarized and translated emails, identified financial conversations and trusted contacts, and helped prepare impersonation and fraud attempts.
• Microsoft notified affected customers, helped remediate compromised accounts, and shared intelligence for further investigation.
• Two men were arrested in London on suspicion of offenses connected with the alleged operation; they were released on bail while the investigation continues.
• Microsoft warned that access may persist after a password reset unless associated sessions and tokens are also revoked.

People

Vendors

Countries

Industries