EvilTokens was a cybercrime platform leveraging AI throughout the phishing attack chain, including generating social engineering messages, selecting targets, and analyzing compromised inboxes. It exploited device code authentication flows, where users enter short codes from devices into browsers, to gain access tokens without passwords. The platform emerged in February 2026 and was used to compromise over 12,000 email accounts at more than 10,000 organizations globally. Microsoft disrupted EvilTokens by seizing 50 websites and disabling over 150 domains, and arrested two suspects in the UK. The platform operated as a paid service charging $1,500 initial and $500 monthly fees. Multiple cybersecurity organizations collaborated in the takedown.

The platform enabled attackers to bypass traditional password-based authentication by abusing device code authentication flows, allowing persistent access to targeted email accounts. Over 12,000 accounts at more than 10,000 organizations worldwide were compromised, potentially exposing sensitive communications and data. The AI-driven approach increased the effectiveness of phishing campaigns and post-compromise exploitation, raising the risk of financial fraud and data theft.

Microsoft has disrupted the EvilTokens platform by seizing infrastructure and arresting key suspects, effectively mitigating the threat. Organizations should ensure device code authentication flows are monitored and consider additional controls to detect suspicious authentication activities. No direct patch is applicable as this is an attack platform rather than a software vulnerability. Continued vigilance against phishing and suspicious authentication requests remains important.