Microsoft dismantles EvilTokens phishing‑as‑a‑service after 12,000 compromised accounts

Microsoft announced on 22 September 2026 that a coordinated effort involving its own security teams, law‑enforcement agencies and several industry partners had successfully dismantled the core infrastructure of EvilTokens, a phishing‑as‑a‑service (PhaaS) operation that had been active since February of the same year and had caused widespread compromise of Microsoft mailboxes.

How EvilTokens abused Microsoft’s authentication flow

EvilTokens took advantage of the OAuth 2.0 device‑code flow, a legitimate authentication mechanism designed to let users sign in on devices that lack a web browser. Victims were redirected to an authentic Microsoft sign‑in page, where they entered a short numeric code displayed on the attacker‑controlled device, inadvertently granting an access token to the malicious actor without ever typing their password.

Because the token was issued by Microsoft’s own authorization server, conventional password‑based detection systems were unable to flag the activity. The issued token conferred both read and write permissions on the victim’s mailbox, allowing the attacker to exfiltrate large volumes of data and to impersonate the user for further malicious actions.

AI‑enhanced reconnaissance and targeting

Custom AI models embedded in the EvilTokens platform automatically scanned compromised mailboxes, mapped internal relationships, and identified high‑value artifacts such as invoices, payment instructions and confidential contracts. The AI then crafted highly personalized spear‑phishing messages for secondary targets, dramatically boosting the success rate of follow‑up attacks.

The service was advertised on Telegram, where operators promoted a $1,500 entry fee and a $500 monthly subscription. Additional optional modules—including bulk credential harvesting and automated invoice forgery—were sold separately, creating a revenue stream that financed ongoing development of the AI tools and the infrastructure needed to sustain the operation.

• Block the OAuth device‑code flow when not required for legitimate scenarios
• Implement continuous monitoring of token issuance and anomalous mailbox activity
• Adopt phishing‑resistant authentication methods such as FIDO2 security keys or passkeys
• Enforce conditional access policies that require MFA for high‑risk applications

Law‑enforcement actions and remaining threats

Coordinated takedown actions resulted in the seizure of 50 hosting sites and the shutdown of more than 150 domains linked to EvilTokens. Two suspects, aged 32 and 38, were arrested in the United Kingdom and later released on bail pending further investigation.

BleepingComputer clarified that the operation was a disruption rather than a complete eradication. Clone services such as APToken have already emerged, indicating that the underlying business model remains attractive to cybercriminals despite the takedown.

Microsoft’s response also included the release of detection signatures for security‑information‑and‑event‑management (SIEM) platforms, enabling organizations to quickly identify tokens issued through the compromised device‑code flow and to generate alerts for suspicious mailbox activity.

The company urged customers to review their OAuth application registrations, revoke any unknown or stale tokens, and apply the recommended hardening steps to reduce the attack surface exposed by the device‑code flow.

Recommended mitigation steps

Beyond the four technical controls listed earlier, Microsoft advises administrators to enforce least‑privilege principles for all OAuth applications, regularly audit consent grants, and implement automated revocation of tokens that show anomalous usage patterns.

Organizations should also consider deploying user‑behavior analytics that can detect unusual mailbox access patterns, such as large volumes of email reads or sends from unfamiliar IP addresses, which may indicate token misuse.

Educating end‑users about the risks of entering device‑code tokens on unsolicited prompts remains a critical layer of defense, especially in environments where users frequently interact with IoT or mobile devices lacking a full browser interface.

Finally, integrating multi‑factor authentication (MFA) for any application that requests elevated mailbox permissions can add a decisive barrier, as the attacker would need to compromise the second factor in addition to the OAuth token.

Impact on enterprises

For English‑speaking enterprises, the practical impact of Microsoft’s disruption is twofold: an immediate reduction in risk due to the removal of active EvilTokens infrastructure, and a longer‑term shift toward stronger authentication practices and tighter token governance.

Organizations that adopt the suggested controls can expect fewer successful phishing breaches, lower incident‑response costs, and a more resilient identity ecosystem, ultimately strengthening their overall security posture in the face of evolving AI‑driven threats.

In the Paris region, several large firms have already begun auditing their OAuth configurations, revoking unused tokens and deploying the new SIEM signatures, reporting a noticeable decline in suspicious mailbox activity since the takedown.