EvilTokens: Microsoft shuts down major AI-powered phishing platform
Microsoft, together with several partners, has stopped the operation of the cybercrime service EvilTokens. This used AI technologies along the entire attack chain to take over email accounts and use them to develop targeted fraud scenarios.
Targeted attacks on mailboxes
After Declarations Microsoft’s platform compromised more than 12,000 mailboxes in over 10,000 organizations worldwide. As part of the operation, 50 websites were confiscated and more than 150 other domains were shut down. Microsoft’s security teams list the developers and operators of EvilTokens under the name Storm-2992. Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, the Shadowserver Foundation and TRM Labs, among others, took part in the measure. In addition, on September 11th, the British Metropolitan Police arrested two men, aged 32 and 38, who were allegedly connected to the service’s commercial operations.
EvilTokens was first documented as a phishing-as-a-service offering in March 2026. The core of the platform was an attack on the OAuth 2.0 device authorization process. For example, victims received a fake message with a device code and were then directed to the real Microsoft login page. Anyone who entered the code there and, if necessary, completed the normal login including two-factor authentication, thereby unnoticed authorized the attacker’s session.
The captured access tokens could then be used to read emails, authorize new devices or create manipulated inbox rules. This allowed attackers to sometimes continue their activities even after a password change, as long as the associated sessions and tokens were not also revoked.
AI is a strong accomplice
EvilTokens became particularly efficient thanks to the integrated AI support. For example, a chatbot was able to analyze compromised mailboxes, identify important business relationships and payment processes, and identify suitable victims for attempted fraud. The system also created messages on request that posed as trusted business contacts. This made it possible to automate part of the previously laborious preparation of business email compromises. According to Microsoft, the platform has been offered commercially since February 2026. Depending on the range of functions booked, users had to pay upwards of 500 dollars (around 430 euros) per month.
The operators are said to have generated income of over a million dollars (around 860,000 euros) in this way. The data evaluated so far shows the international reach of the service. Victims were found in the USA, Canada, Great Britain, Australia, India and France, among others. Sectors such as financial services, healthcare, construction, real estate, wholesale trade and universities were particularly affected.
