In a significant operation involving multiple tech companies and British law enforcement, the phishing-as-a-service (PhaaS) platform EvilTokens has been effectively neutralized. Two suspects, aged 32 and 38, were arrested, leading to the shutdown of 50 websites and the blocking of 150 domains associated with the service. The operation saw collaboration from Microsoft, Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, TRM Labs, and the London Cyber Crime Unit.
EvilTokens, which emerged in February 2026, quickly gained notoriety as one of the leading PhaaS solutions, marketed at $1,500 with a monthly subscription fee of $500. This platform facilitated large-scale phishing attacks by creating counterfeit websites and landing pages aimed at stealing user credentials. Its capabilities extended to capturing session tokens, one-time passwords, and other security codes, granting attackers access to victims' email accounts. A notable feature was its built-in AI assistant, which analyzed victims' email content to identify high-value targets and suggest optimal engagement tactics.
The structure of EvilTokens resembled that of a well-organized startup, offering several AI models, customer support, an administrative dashboard, and tools to guide victims from initial account compromise to financial fraud. Microsoft's investigations revealed that more than 12,000 email accounts from over 10,000 organizations across multiple countries—including the U.S., Canada, the UK, Australia, India, and France—were compromised. Affected sectors included wholesale trade, construction, financial services, real estate, higher education, and healthcare. Microsoft has since notified the victims, assisted in securing compromised accounts, and provided relevant information to law enforcement.
While the recent actions have dealt a significant blow to EvilTokens, it remains uncertain whether these measures will completely dismantle the platform or if it will continue to operate under different guises. This operation highlights the ongoing battle against cybercrime and the necessity for tech firms to collaborate in safeguarding digital spaces. For the market and competitors, this incident underscores the importance of robust cybersecurity measures and may prompt companies to enhance their defenses against emerging threats.
Informational material. 18+.
