Microsoft and Partners Disrupt EvilTokens Phishing Service; Two Suspects Arrested in U.K.
Summary
Microsoft and partners seized 50 websites and disabled over 175 domains linked to EvilTokens, a phishing service associated with 12,000+ compromised inboxes. Two suspected operators were arrested in the U.K. and released on bail.
Key points
- Microsoft and partners seized 50 websites and disabled more than 175 domains linked to EvilTokens under a U.S. federal court order.
- Microsoft linked the service to more than 12,000 compromised Microsoft email inboxes across over 10,000 organizations.
- EvilTokens used AI tools to analyze inboxes and identify trusted relationships and payment details for business-email compromise and financial fraud.
- The service used stolen session tokens to enable inbox access and persistent access, and supported campaigns that bypassed multi-factor authentication.
- Microsoft linked at least 13 FBI complaints to EvilTokens activity, representing about $1.7 million in reported losses; it said total fraud could not be estimated.
- Two suspected operators were arrested in the U.K. and released on bail while the investigation continues.
- The organizations involved in the takedown identified and notified potential victims, shared indicators with partners, and passed intelligence to law enforcement.
Article Details
- Event Type
- Coordinated disruption of EvilTokens, a phishing-as-a-service platform, including the seizure of websites and disabling of associated domains, alongside arrests of two suspected operators.
- Impact
- Microsoft linked EvilTokens to more than 12,000 compromised Microsoft customer email inboxes across more than 10,000 organizations. The service supported business-email compromise and financial fraud by analyzing inboxes and stealing session tokens. At least 13 complaints linked to the service represented approximately $1.7 million in reported losses; Microsoft said this was a conservative estimate.
MITRE ATT&CK
T1078 · Valid AccountsStolen session tokens enabled persistent access to compromised email accounts.T1114 · Email CollectionCybercriminals used the service to analyze and sift through victims' email inboxes.T1528 · Steal Application Access TokenThe service facilitated theft of session tokens used to access victims' email accounts.T1566 · PhishingEvilTokens supported campaigns using highly targeted phishing lures to obtain access to accounts.
People
Felix UtomiIdentified by Microsoft as one of two suspected EvilTokens operators; arrested in the U.K. and released on bail while the investigation continues.Steven MasadaMicrosoft Digital Crimes Unit associate general counsel and general manager who described EvilTokens and its role in facilitating fraud.Waidi Segun AdamsIdentified by Microsoft as one of two suspected EvilTokens operators; arrested in the U.K. and released on bail while the investigation continues.
Threat Actors
Vendors
CloudflareMicrosoft and others involved in the EvilTokens takedown, including Health-ISAC, Cloudflare, OpenAI, Shadowserver and TRM Labs, didn’t fully quantify how much fraud the service enabled, but it gained popularity quicklyCoinbaseCoinbase, which also aided the investigation into EvilTokens, said it traced about $1.1 million in revenue for EvilTokens from its paying customers.MicrosoftMicrosoft and industry partners disrupted EvilTokens, a phishing-as-a-service platform tied to more than 12,000 compromised Microsoft customer email inboxes across over 10,000 organizations worldwide.OpenAIMicrosoft and others involved in the EvilTokens takedown, including Health-ISAC, Cloudflare, OpenAI, Shadowserver and TRM Labs, didn’t fully quantify how much fraud the service enabled, but it gained popularity quicklySpycloudSpyCloud, which supported the takedown, identified compromised email domains spanning 79 countries.
Products
EvilTokensMicrosoft and industry partners disrupted EvilTokens, a phishing-as-a-service platform tied to more than 12,000 compromised Microsoft customer email inboxes across over 10,000 organizations worldwide.Microsoft GraphThe service allowed cybercriminals to map organizational structure and permissions in Microsoft Graph, which enabled lateral movement, researchers said.
Countries
AustraliaVictims of EvilTokens were largely concentrated in the United States, Canada, the United Kingdom, Australia, India and France, according to Microsoft.CanadaVictims of EvilTokens were largely concentrated in the United States, Canada, the United Kingdom, Australia, India and France, according to Microsoft.FranceVictims of EvilTokens were largely concentrated in the United States, Canada, the United Kingdom, Australia, India and France, according to Microsoft.IndiaVictims of EvilTokens were largely concentrated in the United States, Canada, the United Kingdom, Australia, India and France, according to Microsoft.United KingdomTwo suspected operators, Felix Utomi and Waidi Segun Adams, were arrested in the United Kingdom.United StatesVictims of EvilTokens were largely concentrated in the United States, Canada, the United Kingdom, Australia, India and France, according to Microsoft.