Cloudflare joins global operation to disrupt EvilTokens Phishing-as-a-Service platform ...

Cloudforce One works with Microsoft and law enforcement partners to dismantle cybercrime infrastructure targeting Microsoft 365 users globally

DUBAI, UAE: Multi-factor authentication (MFA) has become a fundamental security control for organisations, helping protect employees and corporate applications from stolen credentials. But a new generation of phishing-as-a-service (PhaaS) platforms is demonstrating that attackers are increasingly targeting authenticated sessions and tokens rather than passwords alone.

Cloudflare’s threat intelligence team, Cloudforce One, has joined Microsoft’s Digital Crimes Unit (DCU) and law enforcement and industry partners in a coordinated global operation to disrupt EvilTokens, a PhaaS platform designed to bypass MFA and facilitate Business Email Compromise (BEC) campaigns.

The operation combined legal and technical action to dismantle infrastructure supporting the criminal service. Microsoft initiated civil legal proceedings to seize control of domains associated with EvilTokens, while Cloudforce One conducted a technical disruption of malicious infrastructure operating through Cloudflare, including blocking hundreds of domains and disabling malicious Cloudflare Worker projects.

Making sophisticated cybercrime accessible

EvilTokens first emerged on Telegram in January 2026, offering criminal customers access to a web-based panel that automated the collection of authentication tokens used to access Microsoft Office 365 environments. The platform was designed to enable persistent access even after session tokens expired, allowing attackers to maintain access to compromised accounts and use them in subsequent attacks.

The service also incorporated an AI coach, providing guidance on subjects including Business Email Compromise, U.S. tax documents and typical invoice and accounting correspondence. This effectively gave less experienced cybercriminals assistance in creating convincing phishing lures and impersonation scenarios.

Cloudflare's investigation found that EvilTokens users could provide their own Cloudflare API keys through the criminal panel. These keys were then used to configure Cloudflare Workers capable of collecting credentials and establishing phishing pages. Stolen credentials could subsequently be delivered to attackers through Telegram.

The operation highlights the growing professionalisation of cybercrime, where infrastructure, technical capabilities and even guidance on social engineering techniques can be packaged and sold as a service.

A global threat with regional implications

While EvilTokens operated globally, the tactics used by the platform are particularly relevant to organisations in the Middle East and Africa, where Microsoft 365 and cloud-based collaboration platforms are widely used across government, financial services, professional services, healthcare, education and other sectors.

For regional organisations, the threat extends beyond the theft of usernames and passwords. A compromised corporate mailbox can provide attackers with access to legitimate conversations, contacts, invoices and business processes, potentially enabling highly convincing fraud attempts.

The use of stolen authentication tokens is also significant because it demonstrates how attackers can attempt to exploit an already authenticated session, potentially circumventing security controls that rely primarily on the user completing an MFA challenge.

Coordinated disruption targets the infrastructure behind the attacks

On September 15, Cloudforce One joined Microsoft in a multi-partner operation targeting EvilTokens across both legal and technical fronts. Microsoft identified and analysed domains associated with attacks against its customers and shared intelligence with strategic partners, including Cloudflare. Cloudforce One used its threat intelligence and network visibility to identify the broader infrastructure associated with the operation.

Cloudflare subsequently conducted a technical sweep to remove malicious Workers projects and infrastructure supporting EvilTokens. The company blocked hundreds of domains, suspended associated accounts and developed detections designed to prevent the malicious Workers scripts from being redeployed.

Where domains could not be seized through legal action because of non-cooperating jurisdictions, Cloudflare deployed warning pages designed to prevent victims from reaching the phishing infrastructure.

MFA remains important, but organisations need layered protection

The EvilTokens operation reinforces the need for organisations to look beyond passwords and traditional MFA as a single line of defence. Cloudflare recommends that organisations consider phishing-resistant authentication such as FIDO2, WebAuthn, hardware security keys and passkeys, alongside stronger conditional access controls. Organisations should also monitor session activity, apply appropriate session controls and use email and DNS security measures to identify and block malicious infrastructure.

Cloudflare also recommends strengthening email authentication through properly configured DMARC, SPF and DKIM, alongside technologies capable of detecting suspicious links, attachments and phishing campaigns.

“For organisations across the Middle East and Africa, the incident provides a broader reminder that cybercriminals are adopting the same automation and AI technologies that businesses use to improve productivity, but applying them to scale fraud and credential theft. As phishing-as-a-service continues to lower the technical barrier for attackers, collaboration between cloud providers, security teams, threat intelligence organisations, technology companies and law enforcement will be increasingly important to identify and disrupt criminal infrastructure before it can cause further harm,” said Ercan Aydin, AVP, Middle East, Turkey & Africa at Cloudflare.

For more information and Cloudforce One’s technical analysis of the EvilTokens operation, visit: Cloudflare’s EvilTokens threat report

Cloudflare, Inc. ( / @cloudflare) is on a mission to help build a better Internet. Cloudflare’s suite of products protect and accelerate any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare have all web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures 2018 list and ranked among the World’s Most Innovative Companies by Fast Company in 2019. Headquartered in San Francisco, CA, Cloudflare has offices in Austin, TX, Champaign, IL, New York, NY, San Jose, CA, Seattle, WA, Washington, D.C., Toronto, Lisbon, London, Munich, Paris, Beijing, Singapore, Sydney, and Tokyo.

Disclaimer: The contents of this press release was provided from an external third party provider. This website is not responsible for, and does not control, such external content. This content is provided on an “as is” and “as available” basis and has not been edited in any way. Neither this website nor our affiliates guarantee the accuracy of or endorse the views or opinions expressed in this press release.

The press release is provided for informational purposes only. The content does not provide tax, legal or investment advice or opinion regarding the suitability, value or profitability of any particular security, portfolio or investment strategy. Neither this website nor our affiliates shall be liable for any errors or inaccuracies in the content, or for any actions taken by you in reliance thereon. You expressly agree that your use of the information within this article is at your sole risk.

To the fullest extent permitted by applicable law, this website, its parent company, its subsidiaries, its affiliates and the respective shareholders, directors, officers, employees, agents, advertisers, content providers and licensors will not be liable (jointly or severally) to you for any direct, indirect, consequential, special, incidental, punitive or exemplary damages, including without limitation, lost profits, lost savings and lost revenues, whether in negligence, tort, contract or any other theory of liability, even if the parties have been advised of the possibility or could have foreseen any such damages.