Microsoft-led Operation Disrupts EvilTokens Phishing Service Linked to 12,000 Compromised Accounts

Summary

Microsoft and partners disrupted EvilTokens infrastructure after Microsoft reported the phishing service compromised over 12,000 accounts across more than 10,000 organizations. Two suspected administrators were arrested in the U.K.; the service remains active.

Key points

• Microsoft and partners obtained legal authority to seize infrastructure associated with EvilTokens; the article says the operation was not a full takedown and the threat remains active.
• Microsoft reported more than 12,000 compromised inboxes across over 10,000 organizations worldwide. SpyCloud reported over 8,708 affected accounts across 6,585 corporate email domains in 79 countries.
• EvilTokens used device-code phishing to obtain authentication tokens despite MFA protections, according to the article.
• The service offered 44 customizable phishing kits and AI-powered tools to analyze inboxes, identify high-value targets, and generate business email compromise messages.
• Two men suspected of administering the service were arrested in the U.K. and released on bail pending further investigation.
• Recommended defenses include disabling or blocking device-code authentication where possible, monitoring suspicious logins, and using phishing-resistant authentication such as FIDO2 keys or passkeys.

MITRE ATT&CK

People

Threat Actors

Vendors

Products

Countries

Industries

Related Articles

• Microsoft and Partners Disrupt EvilTokens Phishing Service; Two Suspects Arrested in U.K.Storm-2992 · Microsoft Graph · T1528
• Researcher Demonstrates OAuth Token Theft Through a Sideloaded Windows AppX HostMicrosoft Graph · T1528
• GhostCode Phishing Kit Abuses Microsoft Device-Code Authentication to Steal Account TokensMicrosoft Graph · T1528
• Microsoft Fixed Entra Conditional Access Bypass via Nested App AuthenticationMicrosoft Graph · T1528
• Huntress Details Kali365 Phishing Kit’s Microsoft 365 Token Theft and Fraud ToolsMicrosoft Graph · T1528