Loading threat actor…
Storm-2992 is a financially motivated cybercriminal actor responsible for developing, selling, and supporting EvilTokens, a phishing-as-a-service platform first observed in February 2026. Its two primary operators were identified as residing in the United Kingdom. The actor marketed the platform through Telegram, charging an initial access fee and a recurring subscription. EvilTokens-enabled campaigns compromised more than 12,000 Microsoft email inboxes across over 10,000 organizations worldwide. Affected sectors included financial services, construction, wholesale distribution, healthcare, higher education, and real estate. EvilTokens automates phishing that abuses the legitimate OAuth device authorization flow. Attackers initiate authentication and persuade victims to enter attacker-generated device codes at Microsoft's genuine sign-in portal. Victims thereby authorize attacker-controlled sessions, including when they complete multifactor authentication, without directly disclosing passwords to attackers. The platform provides phishing templates, dynamically generated device codes, automated authorization polling, token management, and AI-assisted lure customization. Its delivery infrastructure uses staged redirects, fake verification pages, attachments, and legitimate cloud services to evade security controls. EvilTokens customers use acquired access and refresh tokens to access and exfiltrate email, conduct Microsoft Graph reconnaissance, and send follow-on phishing from trusted accounts. AI-assisted mailbox analysis identifies organizational relationships, payment authorities, invoices, and financial conversations to support business email compromise and payment diversion. Persistence and concealment techniques include token refreshing, malicious inbox rules, and registration of additional devices to obtain Primary Refresh Tokens. Microsoft and public- and private-sector partners disrupted EvilTokens infrastructure in September 2026, seizing 50 websites and disabling more than 150 supporting domains. UK police arrested two suspected participants, who were released on bail pending further investigation.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
24 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
3 indicators attributed to this actor. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.