Loading story…
Microsoft, Health-ISAC, law enforcement, and private-sector partners disrupted EvilTokens, an AI-enabled phishing-as-a-service platform attributed to threat actor Storm-2992. A federal court order enabled the seizure of 50 EvilTokens websites and the disabling of more than 175 supporting domains; UK Metropolitan Police also arrested two suspected operators in the greater London area. The service was linked to more than 12,000 compromised Microsoft customer inboxes across over 10,000 organizations worldwide, while known FBI IC3 complaints associated it with approximately $1.7 million in losses.
EvilTokens conducted OAuth 2.0 device-code phishing against Microsoft Entra ID, directing victims to Microsoft’s legitimate device-login page and capturing access and refresh tokens after authentication, thereby bypassing the practical protections of MFA. The platform used Microsoft Graph API access and an AI-style chatbot to examine stolen mailboxes for trusted contacts, payment information, high-value users, and global administrators, supporting business-email-compromise and financial-fraud operations. SpyCloud contributed recaptured data involving more than 8,700 victims, reporting that 97.5% of affected accounts were on enterprise domains; Coinbase traced roughly $1.1 million in revenue paid by the platform’s customers to its operators.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
The Metropolitan Police executed warrants in the greater London area and arrested two men, aged 32 and 38, on suspicion of making articles for use in fraud and money laundering. Police seized their digital devices and released both suspects on bail pending further investigation.
Microsoft and partners disrupted EvilTokens under a federal court order, seizing 50 websites used by the service and disabling more than 175 supporting domains.
Microsoft provided the UK Metropolitan Police with information concerning EvilTokens administrators, supporting the subsequent law-enforcement investigation.
Microsoft tracked an EvilTokens-aligned campaign that used automation platforms to deploy thousands of unique, short-lived polling nodes running Node.js backend logic. The infrastructure supported device-code phishing authorization monitoring while making detection and takedown more difficult.
Microsoft observed 10 to 15 distinct EvilTokens phishing campaigns launching every 24 hours beginning March 15, 2026, indicating sustained operational use of the platform.
SpyCloud recorded its first EvilTokens-related device-code token captures, marking observed victim activity associated with the platform.
EvilTokens, an AI-enabled phishing-as-a-service platform targeting Microsoft accounts, launched in February 2026.
Microsoft disclosed that EvilTokens, tracked as Storm-2992, compromised more than 12,000 Microsoft inboxes at over 10,000 organizations worldwide, facilitating business email compromise. SpyCloud data associated with the operation included more than 8,708 compromised accounts across 6,585 corporate email domains in 79 countries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
8 references tracked. Mallory keeps watching after this page renders.
trmlabs.com
Open sourcemalware.news
Open sourcetherecord.media
Open sourcecyberscoop.com
Open sourcemicrosoft.com
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourcespycloud.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **EvilTokens** phishing-as-a-service platform is being used to steal Microsoft 365 access tokens through OAuth **device code phishing**, with one campaign abusing free **Notion** accounts and malicious PDFs to lure victims. In the activity tracked as **Doubloon Dredger**, attackers sent legitimate-looking Notion document-sharing notifications from compromised accounts impersonating senior executives, then redirected targets to phishing pages disguised as Adobe Acrobat authentication prompts. Victims were instructed to enter a verification code on Microsoft’s legitimate sign-in or device code page, allowing Microsoft to issue authorization tokens directly to the attackers without requiring password theft. The operation has targeted organizations in manufacturing, telecommunications, retail, healthcare, and logistics, and researchers said EvilTokens has been active since at least February 2026 and is marketed largely through Telegram. Flare said the platform goes beyond session theft by analyzing compromised mailboxes, using AI to summarize content and identify likely fraud opportunities, and helping operators craft tailored business email compromise messages based on real payment workflows and relationships. Reported activity included a 16-day wave affecting **344 organizations across five countries**, while separate research found more than **1,000** infrastructure-related search results and **66** email attachments leading to EvilTokens pages; defenders were urged to restrict or disable device-code authentication where possible and monitor for anomalous token grants, inbox rule creation, mailbox searches, token reuse, and suspicious outbound email.
Aug 25, 2026
Huntress reported that the **EvilTokens** phishing-as-a-service operation used Microsoft’s legitimate device code authentication flow to steal valid session tokens from users without capturing passwords or directly breaking MFA. The campaign accelerated in early March after initial alerts in late February and affected **344 organizations across five countries over 16 days**. According to Huntress and Microsoft, the operation relied on trusted cloud infrastructure hosted on Railway and phishing lures tailored to victims’ normal workflows, allowing the activity to blend in with legitimate sign-in behavior. Researchers said EvilTokens is marketed on Telegram and uses **AI-enhanced phishing** to personalize messages, evade email filtering, identify financially valuable targets, and automate follow-on fraud using context taken from compromised accounts. Because the emails, URLs, and authentication steps appeared legitimate, traditional email defenses often failed to stop the attacks. Huntress recommended behavior-based detection, stricter Conditional Access policies, monitoring for suspicious device registrations, rapid token revocation, and wider adoption of phishing-resistant MFA such as **FIDO2** security keys and passkeys.
Jun 29, 2026
The phishing-as-a-service platform **EvilTokens** sharply expanded attacks against Microsoft 365 accounts by abusing Microsoft’s legitimate **device code OAuth flow** to steal access tokens after victims completed real Microsoft logins and multi-factor authentication. Huntress reported a **1,380% increase** in device code phishing activity between late 2025 and early 2026, with campaigns affecting hundreds of organizations. The operation used **AI-generated personalized phishing lures** and automated post-compromise analysis to support follow-on business email compromise, while relying on legitimate cloud services including **Railway**, **BL Networks/BitLaunch**, and **Cloudflare Workers** to blend in with normal traffic. EvilTokens was marketed openly on **Telegram** as a subscription service priced from **$600 to $1,500**, lowering the barrier for less sophisticated criminals to launch token-theft campaigns that can bypass MFA protections. Huntress said **57.5%** of observed attacks were tied to Railway or BL Networks infrastructure, and that blocking Railway IP addresses through Conditional Access prevented more than **600 incidents** before attackers shifted hosting. Defenders were urged to restrict or block device code authentication where possible, review sign-in logs for suspicious Railway-originated authentications, revoke stolen tokens, audit Microsoft Graph API activity, and update user awareness training because genuine Microsoft login pages can still be part of a phishing attack.
Jun 29, 2026