Microsoft, in collaboration with law enforcement, has successfully disrupted the phishing platform EvilTokens, which compromised over 12,000 email accounts across 10,000 organizations globally. In a significant development, two individuals suspected of administering the service were arrested in the United Kingdom.
EvilTokens, identified by Microsoft under the code name Storm-2992, emerged in February 2026 and focused on device-code phishing targeting Microsoft accounts. The victims included firms from various sectors, including finance, construction, real estate, healthcare, wholesale trade, and educational institutions.
What set EvilTokens apart was its innovative approach to bypass credential theft. The platform exploited the legitimate OAuth 2.0 Device Authorization Grant mechanism, which is designed for devices with limited input capabilities, such as televisions and conference equipment.
The phishing scheme operated as follows: the attacker would request authorization from Microsoft for a new device on behalf of the victim. Microsoft would respond with a one-time device code, which the attacker then sent to the victim via phishing emails, persuading them to enter the code on the legitimate Microsoft login page. Consequently, the user would see a genuine login screen, input their credentials, and potentially confirm access through multi-factor authentication. This process inadvertently granted the attacker access to the victim's account without ever needing the password.
Once an account was compromised, EvilTokens utilized Microsoft Graph and AI tools to analyze the victim's email. The malware gathered information about the victim's internal connections and employed AI to scrutinize email content, searching for financial communications and identifying key contacts for future attacks.
The service provided attackers with insights to select subsequent targets, draft convincing emails for business email compromise (BEC) schemes, and even translate and summarize communications in unfamiliar languages. Access to EvilTokens was available through Telegram for $500 a month or a lifetime subscription for $1,500, offering clients a suite of phishing tools and templates masquerading as Microsoft.
To evade detection, the platform's operators employed a myriad of tactics, including lengthy redirect chains, PDF and HTML attachments, fake CAPTCHAs, compromised websites, and services like Vercel, Cloudflare Workers, and AWS Lambda.
In the operation against EvilTokens, Microsoft obtained court approval to seize the platform's infrastructure, leading to the confiscation of 50 websites and the disabling of over 150 associated domains. Several organizations, including Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs, supported the operation.
The arrests of the two suspects, aged 32 and 38, were announced by the UK police, although both were later released on bail pending further investigation.
This disruption signals a significant blow to the phishing landscape, potentially deterring similar operations and altering the competitive dynamics in the cybercrime market.
Informational material. 18+.
