{"id":3063,"date":"2026-09-22T18:05:57","date_gmt":"2026-09-22T18:05:57","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3063"},"modified":"2026-09-22T18:05:57","modified_gmt":"2026-09-22T18:05:57","slug":"microsoft-takes-down-eviltokens-device-code-phishing-service-tied-to-12000-inbox-compromises","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3063","title":{"rendered":"Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises"},"content":{"rendered":"
\n
<\/a><\/div>\n

Microsoft on Tuesday announced<\/a> the takedown of the EvilTokens<\/strong> device code phishing service that it said used artificial intelligence (AI) \u00abat every step of the attack chain.\u00bb<\/p>\n

The action, carried out with authorization<\/a> from the U.S. District Court for the Eastern District of Virginia, involved the efforts of Health-ISAC, alongside Cloudflare<\/a>, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs. Microsoft is tracking the threat actors behind the development and support of EvilTokens as Storm-2992<\/a><\/strong>.<\/p>\n

In tandem, the Metropolitan Police Service arrested two men, aged 32 and 38, on September 11, 2026, in connection with the illicit commercial operation. The tech giant described EvilTokens as a \u00abpowerful cybercrime platform\u00bb that used AI to compromise email accounts and design roadmaps for financial fraud and scams.<\/p>\n

\u00abWhile EvilTokens helped cybercriminals access email accounts, at the center of the service was an AI-style chatbot that could analyze a victim’s inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other circumstances where fraud was most likely to succeed,\u00bb Steven Masada, associate general counsel and general manager at Microsoft’s Digital Crimes Unit, said.<\/p>\n

\u00abThe platform could even recommend fraud strategies, including drafting messages that impersonated trusted contacts to help criminals trick victims into taking action.\u00bb<\/p>\n

EvilTokens was first documented by Huntress in March 2026 as a phishing-as-a-service (PhaaS) platform that abused<\/a> the OAuth 2.0 device authorization flow<\/a> to give attackers authenticated sessions with victim accounts without having to supply any credentials at their end.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The stolen tokens are abused for email exfiltration and persistence, often by setting malicious inbox rules that conceal communications. In some cases, the tokens have also been abused to grant new devices access to a victim’s inbox, thereby giving attackers an alternative pathway to maintaining long-term access.<\/p>\n

<\/p>\n

The malicious lure, typically delivered via phishing attacks, shows the user a device code for the service that the threat actor wishes to access. The victim is then prompted to enter this code at the legitimate verification URL (e.g., microsoft.com\/devicelogin) during the sign-in process.<\/p>\n

Once the code is supplied, the authorization server issues access and refresh tokens to the attacker’s client, granting them ongoing access under the victim’s identity.<\/p>\n

\"\"<\/a><\/div>\n

\u00abEvilTokens packaged account takeover, AI-driven mailbox analysis, and fraud tooling into a single commercial service, lowering the expertise once needed to run business email compromise and invoice fraud at scale,\u00bb TRM Labs said<\/a>.<\/p>\n

In a report published in late March 2026, Sekoia characterized EvilTokens as a turnkey solution sold under a PhaaS model on Telegram since mid-February, offering customers a plethora of self-hosted phishing templates and AI-powered features to automate business email compromise (BEC) workflows, such as analyzing harvested emails, identifying finance-related email threads, and drafting BEC emails.<\/p>\n

Some of the Telegram accounts, channels, and groups linked to EvilTokens are below –<\/p>\n