Microsoft and Partners Disrupt EvilTokens AI-Powered Phishing Service

• •EvilTokens compromised over 12,000 email accounts using AI-driven phishing techniques.
• •The platform exploited Microsoft's device code authentication flow to bypass MFA.
• •Microsoft and partners seized 50 websites and arrested two suspects linked to the operation.

Microsoft, in collaboration with various partners, has successfully disrupted EvilTokens, a phishing-as-a-service platform that compromised over 12,000 Microsoft 365 accounts across more than 10,000 organizations globally. The platform exploited the OAuth 2.0 device code authentication flow, allowing attackers to obtain valid access tokens without needing passwords, effectively bypassing multi-factor authentication (MFA). The service, which emerged in February 2026, utilized AI to automate phishing campaigns and analyze compromised inboxes for financial fraud opportunities. Microsoft seized 50 websites and disabled over 150 domains associated with EvilTokens, while two suspects were arrested in the UK. The operation has been linked to approximately $1.1 million in revenue traced through cryptocurrency transactions. The disruption highlights the growing sophistication of cybercrime as a service, making it accessible to less experienced criminals.