NewsPublished 22 Sep 2026

EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts

Source Bleeping Computer

Description

The EvilTokens platform, responsible for compromising over 12,000 Microsoft accounts across more than 10,000 organizations, has been disrupted through an operation led by Microsoft's Digital Crimes Unit. This disruption aims to halt the platform's malicious activities targeting Microsoft accounts.

Impact

The compromise affected a large number of Microsoft accounts, potentially exposing sensitive organizational data and user information across more than 10,000 organizations. The disruption of the EvilTokens platform mitigates ongoing risk from this threat actor's activities.

Defensive guidance

The EvilTokens platform has been disrupted by Microsoft's Digital Crimes Unit, effectively mitigating the threat. No further immediate action is indicated based on the provided information.

Summary

EvilTokens is a platform that facilitated the compromise of more than 12,000 Microsoft accounts at over 10,000 organizations. The platform's disruption was achieved through coordinated efforts led by Microsoft's Digital Crimes Unit, effectively interrupting its operations. No specific technical details about the compromise methods or vulnerabilities exploited are provided in the available information.

References

bleepingcomputer.com/news/security/eviltokens-phaas-disrupted-after-compromising-12-000-microsoft-accounts/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Sep 2026, 15:17 UTC

References

Community reviews