Microsoft Dismantles EvilTokens, an AI-Assisted Phishing Service Linked to 12,000 Inboxes

On 22 September 2026 Microsoft said it had dismantled EvilTokens, a phishing-as-a-service platform linked to more than 12,000 compromised email inboxes at over 10,000 organisations. After its February 2026 launch, victims were concentrated in the United States, Canada, the United Kingdom, Australia, India and France, tricked into typing a one-time code into Microsoft's genuine sign-in page, giving attackers access to their mail without surrendering a password. At the centre of the service was an AI assistant that read the stolen inbox, identified who approves payments and who is worth impersonating, and drafted the follow-up message. Microsoft's Digital Crimes Unit won court authorisation in Virginia, seized 50 websites and disabled more than 150 domains; British police arrested two men on 11 September. The archive's full record of the takedown, with its grading and cited sources, sits in the AI incident archive alongside the other entries in this series.

The platform, and the sign-in trick it industrialised

EvilTokens did not need passwords. It abused the OAuth device authorisation flow, the mechanism behind sign-in on devices with no keyboard or browser — smart televisions, printers, conferencing units and Microsoft Teams rooms. That flow shows a short code on one device and asks the user to type it into a browser session on another. Microsoft's Security Blog explains why that separation is the weakness: whoever starts the flow is the party that ends up authenticated.

In the chain Microsoft's threat-intelligence team describes, a pressure-themed email — an invoice, a file-sharing notice — leads to an attacker page. A background script on that page talks to Microsoft's identity provider in real time and generates a live device code, which it displays with a copy button next to a "Continue with Microsoft" link. That link goes to the genuine microsoft.com/devicelogin portal. While the victim authenticates, the script polls a /state endpoint on the attacker's own server every three to five seconds for the fifteen-minute life of the code, waiting to see whether the login has landed. Because a browser with an existing session can complete the step in seconds, the code is often copied to the clipboard and pasted straight through. The victim's password is never typed into anything the attacker controls, and no password reset undoes what happened: "That access could persist even after a password reset if the associated sessions and tokens were not also revoked," Steven Masada, associate general counsel and general manager of Microsoft's Digital Crimes Unit, wrote in the unit's post.

What the platform added was repeatability. Microsoft says EvilTokens shipped 44 different phishing themes and a set of templates and landing pages, and that the actor it tracks as Storm-2992 advertised, sold, updated and supported the kit on Telegram. An April 2026 campaign, the Security Blog reports, used automation platforms to spin up thousands of unique, short-lived polling nodes with Node.js backend logic, a design aimed squarely at defeating signature-based detection. Microsoft credits Huntress for observations about the themes in circulation, including construction bid proposals and password-expiry notices. Post-compromise, the Security Blog notes, some operators registered a new device within ten minutes to obtain a Primary Refresh Token for durable access; others waited hours before creating inbox rules and exfiltrating mail.

What the AI did inside the mailbox

Microsoft's own description of the AI is more specific than the headline phrase "used AI at every step of the attack chain," and worth reading closely. At the centre of the service, the Digital Crimes Unit says, was "an AI-style chatbot that could analyze a victim's inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other circumstances where fraud was most likely to succeed." It could summarise and translate email, surface financial conversations, map organisational roles and recommend targets. Preset prompts let a subscriber search for wire-transfer discussions, find the organisation's "money movers", locate vendor invoices and rank the best people to impersonate. It could also draft messages posing as trusted contacts.

That is analysis and drafting, not autonomy. The system read what an operator had already stolen, ranked it, and proposed a next move; a paying customer chose whether to send. None of the material reviewed here describes EvilTokens composing and dispatching lures without a human subscriber, or moving funds itself. The complaint Microsoft and Health-ISAC filed calls the scheme "a sophisticated business email compromise conspiracy powered by end-to-end deployment of artificial intelligence agents" — that is the plaintiffs' characterisation in a legal pleading, and the functions it goes on to describe are retrieval, ranking and drafting inside a control panel a customer operates.

The most concrete detail of the AI stack comes from that complaint, which Microsoft publishes through its Digital Crimes Unit. It alleges the defendants integrated Groq's AI services into early versions of the EvilTokens control panel and, more recently, OpenAI's services into an updated one, and it reproduces a system prompt that casts the assistant as a seasoned business email compromise operator and wire transfer fraud specialist, available by default to every end user. Microsoft's investigators also concluded that large portions of the platform were "vibe coded," with AI helping its creators build it, and that it "drew on capabilities from multiple AI models." Asked which others, a Microsoft spokesperson declined to say, The Record reports. OpenAI is separately credited as a partner in the disruption.

The numbers, and who counted them

The headline scale is Microsoft's. "Within months of launching in February 2026, EvilTokens had been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide," the Digital Crimes Unit wrote; the Security Blog repeats the figure, and SecurityWeek and Help Net Security both carry it. The complaint says the same in its own terms — "over 12,000 Microsoft compromised victims." No independent body has published a separate tally, and Health-ISAC's role was to join as co-plaintiff because healthcare organisations were among the targets, not to audit the count.

Microsoft reports the highest concentrations of victim activity in the United States, Canada, the United Kingdom, Australia, India and France, and lists the affected sectors as wholesale distribution, construction, financial services, real estate, higher education and healthcare. The "highest concentrations" phrasing matters: those six countries are where activity clustered, not a complete list of where victims were. The complaint alleges the enterprise existed to "facilitate millions of dollars' worth of financial crimes," but the public statements reviewed for this article give no loss figure, and no victim has been named.

One structural point bears on how much weight the counts can carry. Microsoft is the identity provider whose sign-in page the scheme abused, the investigator that reverse-engineered the platform, and the source of the victim numbers — the same organisation in all three roles. Its account is detailed and internally consistent, and it is corroborated on every point that independent outlets checked, including the pricing, the mechanism and the arrests. The victim counts have not been independently verified.

The takedown: a civil case, two arrests, and what they do not establish

Microsoft's action ran on two tracks. In the United States, the Digital Crimes Unit obtained authorisation from the U.S. District Court for the Eastern District of Virginia, with Health-ISAC as co-plaintiff, and then worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs "to act against key parts of the platform," in its words. Microsoft says it seized 50 websites used to operate the service and disabled more than 150 additional domains tied to its infrastructure. It calls the operation its 40th court-authorised disruption and its first against what it terms "an end-to-end AI-enabled cybercrime service."

The complaint behind that action names two defendants resident in the United Kingdom — Felix Utomi and Waidi Segun Adams — plus five unnamed parties, DOES 1-5, and pleads violations of the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, the Lanham Act and the Racketeer Influenced and Corrupt Organizations Act. The copy published by Microsoft's Digital Crimes Unit is stamped "filed under seal," carries no case number, and describes two infrastructure-provider defendants, three support staff described only by their Telegram handles and job titles, and two end users whose access included a Virginia-based Microsoft customer and a Virginia-based Health-ISAC member. SecurityWeek reports that the complaint also targets five unnamed individuals. The archive's summary of the case records that a UK-registered company behind the platform is named in the pleadings; the published caption names individuals only, and neither Microsoft's posts nor the reporting reviewed here identifies a corporate defendant.

Separately, the Metropolitan Police Service's cybercrime team arrested two men, aged 32 and 38, on 11 September 2026, seizing digital devices and other items. Both were released on police bail with conditions while the investigation continues, the Digital Crimes Unit said. The Met confirmed the arrests to The Record and said the men were held on suspicion of making articles for use in fraud and money laundering; Microsoft, which reported the matter to the force in August, declined to identify them to that outlet. Detective Inspector Serena D'Adamo, whose team led the investigation, said: "Phishing services bring misery to thousands, taking money from everyday people across the world."

What the record does not contain is equally worth stating. No charges have been announced. No court has made a finding against anyone. Being named in a civil complaint is an allegation, not a conviction, and the two men arrested were bailed rather than charged. Nothing published indicates the seized infrastructure has been traced to a specific fraud loss; neither Microsoft's posts nor the coverage reviewed here ties it to one, and Microsoft's own framing is that disruption is not eradication: "The infrastructure supporting EvilTokens has been disrupted, but the model it demonstrated will not disappear with it," Masada wrote.

What Microsoft says defenders should do

The Security Blog's guidance is unusually concrete, and it is the part of the episode with the widest applicability. Its first recommendation is to block the device code flow outright wherever it is not needed; where Teams devices require it, to narrow the exception to specific Teams device resource accounts and exclude the Device Registration Service resource from Conditional Access. Beyond that it advises phishing-resistant multi-factor authentication such as FIDO tokens or Microsoft Authenticator passkeys, blocking legacy authentication and avoiding telephony MFA; enabling Safe Links, which it says also enables high-confidence device code phishing alerts; raising the Advanced Phishing Threshold to 2 or 3; turning on zero-hour auto purge; and alerting on suspicious inbox-rule creation.

For responders, the Security Blog flags a trap that explains why these intrusions persist. Standard session revocation with revokeSignInSessions may invalidate only refresh tokens, leaving access tokens valid for up to an hour — so Microsoft recommends temporarily disabling a compromised account for immediate containment, and treating suspected refresh-token theft with its token-theft playbook. The Digital Crimes Unit adds a control no product supplies: independently verify requests to change payment information, redirect funds or approve unusual transactions through a trusted second channel. The unit's stated lesson for organisations is that "once an inbox is compromised, criminals may understand its contents in minutes, not days."

None of that guidance has been independently evaluated, and the record contains no measurement of how many of the affected organisations had device code flow enabled, or how many have since blocked it. Microsoft has notified affected customers and helped remediate compromised accounts, it says; what individual organisations did in response is not public.

The archive classifies the entry as a realised incident, severity high, confidence A, not disputed, with real harm recorded and AI involvement confirmed, dated to the single day of Microsoft's announcement. That grading reflects how well the event is documented — two Microsoft posts, a court filing and independent coverage that agrees on the mechanism, the pricing and the arrests — and it is the reason this account can be specific about the attack chain. It does not convert Microsoft's victim counts into an audited figure, and it does not make the civil allegations against two named men into findings. The more durable point may be the one Microsoft makes against its own interest: the infrastructure is down, and the template — a stolen session, an assistant that reads the inbox, and a fraud plan drafted in minutes — is not.