Two Men Arrested in UK After Microsoft Disrupts AI-Powered EvilTokens Phishing Service
Summary
Microsoft says a court-authorized takedown disabled EvilTokens, an AI-powered phishing service linked to more than 12,000 compromised inboxes. UK police arrested two men suspected of operating it; both were released on bail.
Key points
- Microsoft obtained court authorization to take EvilTokens offline and worked with UK police, who arrested two men suspected of operating the service. Both were released on bail as the investigation continues.
- Microsoft said EvilTokens was linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide.
- The service used AI to analyze inboxes, identify trusted relationships and likely fraud targets, and recommend impersonation and scam tactics.
- EvilTokens automated device-code phishing, allowing attackers to obtain account access without victims providing their passwords; the access could persist even after password changes.
- Microsoft said it seized 50 websites used to operate the service and disabled 150 additional domains tied to its infrastructure.
- Microsoft said the service launched in February 2026 and that the takedown was its first court-authorized disruption targeting an end-to-end AI-enabled cybercrime service.
Article Details
- Event Type
- Microsoft-led, court-authorized takedown of EvilTokens, an AI-powered phishing service, alongside arrests in the U.K.
- Impact
- Microsoft said EvilTokens was linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide. It automated device-code phishing, inbox analysis, fraud targeting, and impersonation tactics. Microsoft seized 50 websites used to operate the service and disabled 150 additional domains tied to its infrastructure. U.K. police arrested two suspected operators; both were released on bail while the investigation continued.
MITRE ATT&CK
T1114 · Email CollectionThe service analyzed compromised email inboxes to identify financial conversations, trusted relationships, and fraud targets.T1528 · Steal Application Access TokenThe device-code phishing flow tricked victims into authorizing an attacker-initiated session, granting account access without disclosing passwords.T1566 · PhishingEvilTokens was used to send deceptive phishing emails with malicious URLs, PDFs, or other file types.T1656 · ImpersonationEvilTokens could draft messages impersonating trusted contacts to deceive victims.
People
Vendors
Cloudflare#EvilTokensCoinbase#EvilTokensMicrosoftMicrosoft disrupted EvilTokens, an AI-powered phishing service that helped criminals automate account compromise, inbox analysis, and fraud targeting.OpenAIAs we note in our blog, OpenAI was an important partner in this disruption effort,” the Microsoft spokesperson said, declining to provide specifics on what other AI platforms were used to run EvilTokens.
Products
Countries
AustraliaThe organizations attacked were concentrated in the U.S., Canada, U.K., Australia, India and France.CanadaThe organizations attacked were concentrated in the U.S., Canada, U.K., Australia, India and France.FranceThe organizations attacked were concentrated in the U.S., Canada, U.K., Australia, India and France.IndiaThe organizations attacked were concentrated in the U.S., Canada, U.K., Australia, India and France.