Microsoft Disrupts AI-Driven Phishing Service EvilTokens

• •EvilTokens compromised over 12,000 email accounts across 10,000 organizations.
• •Microsoft's operation seized 50 websites and disabled 150 domains linked to the cybercrime service.
• •The attack leveraged AI to identify targets for phishing and fraud.

Microsoft has disrupted the EvilTokens cybercrime service through a court-authorized operation in collaboration with law enforcement and industry partners. The operation resulted in the seizure of 50 websites and the disabling of over 150 related domains. EvilTokens had compromised more than 12,000 email inboxes across 10,000 organizations, utilizing AI to identify payment conversations and potential impersonation targets. The attack method involved sifting through stolen emails to facilitate fraud attempts. Microsoft shares remained flat at $497.64 as of September 23, 2026, 15.2% below its estimated fair value. The operation aims to enhance account protection for Microsoft 365 users, with a focus on preventing future compromises. The current status indicates that while infrastructure has been removed, the challenge remains in preventing future attacks.