PhishingPublished 23 Sep 2026

AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft

Source SecurityWeek

Description

EvilTokens was an AI-powered phishing platform that enabled cybercriminals to compromise over 12,000 email accounts across more than 10,000 organizations worldwide by abusing device code authentication flows. The platform used AI to craft targeted phishing messages, select victims, and extract valuable data from compromised accounts. Microsoft disrupted the platform by seizing infrastructure and arresting two suspects linked to its operation. The platform charged users for access and offered numerous phishing themes to increase success rates.

Impact

The platform enabled attackers to bypass traditional password-based authentication by abusing device code authentication flows, allowing persistent access to targeted email accounts. Over 12,000 accounts at more than 10,000 organizations worldwide were compromised, potentially exposing sensitive communications and data. The AI-driven approach increased the effectiveness of phishing campaigns and post-compromise exploitation, raising the risk of financial fraud and data theft.

Defensive guidance

Microsoft has disrupted the EvilTokens platform by seizing infrastructure and arresting key suspects, effectively mitigating the threat. Organizations should ensure device code authentication flows are monitored and consider additional controls to detect suspicious authentication activities. No direct patch is applicable as this is an attack platform rather than a software vulnerability. Continued vigilance against phishing and suspicious authentication requests remains important.

Summary

EvilTokens was a cybercrime platform leveraging AI throughout the phishing attack chain, including generating social engineering messages, selecting targets, and analyzing compromised inboxes. It exploited device code authentication flows, where users enter short codes from devices into browsers, to gain access tokens without passwords. The platform emerged in February 2026 and was used to compromise over 12,000 email accounts at more than 10,000 organizations globally. Microsoft disrupted EvilTokens by seizing 50 websites and disabling over 150 domains, and arrested two suspects in the UK. The platform operated as a paid service charging $1,500 initial and $500 monthly fees. Multiple cybersecurity organizations collaborated in the takedown.

References

securityweek.com/ai-powered-phishing-platform-eviltokens-disrupted-by-microsoft/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 23 Sep 2026, 11:32 UTC

References

Community reviews

Related threats