AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft

Microsoft announced on Tuesday that it disrupted EvilTokens, an AI-powered phishing platform used by cybercriminals to target many organizations worldwide.

EvilTokens emerged in February 2026, and according to Microsoft, it has been used to compromise more than 12,000 email accounts at over 10,000 organizations, including in the US, Canada, the UK, Australia, India, and France.

The platform enabled threat actors to gain access to targeted accounts via device code phishing , which targets the device code authentication flow designed for devices that don’t support standard login methods, such as TVs and printers. The authentication process requires the user to enter a short code presented on the device into a web browser session on a separate device.

Threat actors can abuse this by initiating the authentication flow and providing the code to the targeted user via a phishing lure. If the user is convinced to complete the authentication process in a browser using the attacker’s code, they are giving the attacker access to the account without handing over passwords.

EvilTokens facilitated this process, making it easier for cybercriminals to obtain access tokens that could provide persistent access to email accounts.

The platform used AI throughout the attack chain, including to create phishing emails customized for specific targets to increase the chances of success. EvilTokens offered 44 different themes for the malicious emails and phishing pages.

Once access was gained to an account, AI helped EvilTokens users go through victims’ inboxes for valuable data. “[AI] helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible,” Microsoft said.

Microsoft believes the platform itself was also coded using AI.

To access and use EvilTokens, cybercriminals had to pay $1,500 for initial access and a $500 monthly fee.

Microsoft seized 50 websites used to run the service and disabled more than 150 other domains linked to the platform’s infrastructure.

In addition to the technical disruption, Microsoft announced that two men suspected of being linked to the operation of EvilTokens — Felix Utomi and Waidi Segun Adams — have been arrested in the United Kingdom.

Microsoft named the suspects in a complaint filed as part of its efforts against the phishing platform. The complaint also targets five unnamed individuals.

SpyCloud , TRM Labs , Coinbase , Health-ISAC, Cloudflare, OpenAI, Railway, and The Shadowserver Foundation also contributed to the EvilTokens takedown.

Related : 15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown

Related : NightmareStresser DDoS Service Disrupted in International Operation

Related : 23-Year-Old Sality P2P Botnet Disrupted

Related : GlassWorm Botnet Disrupted

Artificial Intelligence

Microsoft Patches 18 Vulnerabilities in AI, Cloud Products

Microsoft fixed vulnerabilities across Azure and AI-branded products, with privilege escalation flaws accounting for the majority.

NightmareStresser DDoS Service Disrupted in International Operation

Active since at least 2022, NightmareStresser was one of the longest-running DDoS-for-hire services in the world.

Artificial Intelligence

Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow?

Microsoft agreed to adopt guardrails and privacy standards for its AI in schools, as negotiated with the American Federation of Teachers.

Artificial Intelligence

Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints

The Humanist AI Code of Conduct draws a line between defensive cyber research and operational attack capability.

Phishing Research Challenges Conventional Security Awareness Testing

Analysis of 2.47 million simulated attacks shows why organizations should measure credential leaks and reporting, not just clicks.

Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack

Hackers compromised the Brevo marketing platform and used that access to send phishing emails to users of Trezor, BitBox, and CoinTracking.

New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser

Attackers are using trusted Microsoft services and blob URLs to generate stealthy phishing pages that leave defenders with no static website to detect or...

Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

The record-breaking September security update fixes two exploited privilege-escalation zero-days and 20 potentially wormable vulnerabilities.