Microsoft and partners dismantle EvilTokens AI-powered phishing platform
EvilTokens was an AI-powered phishing-as-a-service platform sold on Telegram that used machine learning to identify payment decision-makers and create targeted fraud emails. The platform bypassed multi-factor authentication on Microsoft 365 accounts across over 10,000 organizations before Microsoft and partners dismantled it in September 2026.
What happened
EvilTokens was a phishing-as-a-service platform launched on Telegram in mid-February 2026 that sold do-it-yourself phishing kits for between $100 and $300 per month. The kit included an AI-powered analyst that mapped trusted relationships, identified who controlled payments, and flagged where fraud was most likely to succeed.
The platform exploited Microsoft's device authorization grant flow by directing victims to real Microsoft pages and asking them to enter a device code generated by attackers, enabling attackers to obtain persistent OAuth tokens that granted full access to Microsoft 365 accounts and bypassed multi-factor authentication. The operation compromised more than 12,000 Microsoft 365 inboxes across over 10,000 organizations globally, with independent analysis finding 8,708 accounts spanning 6,585 domains across 79 countries.
On September 22, 2026, Microsoft's Digital Crimes Unit announced it had dismantled the core infrastructure behind EvilTokens in coordination with Coinbase, Health-ISAC, SpyCloud, and local law enforcement. Two UK administrators, aged 32 and 38, were arrested and subsequently released on bail while investigations continue.
Reported impact
The platform defrauded businesses ranging from real estate firms to banks to healthcare providers of millions of dollars through phishing emails. Device-code phishing attacks increased by 1,380% in the period following the platform's launch.
Index analysis
The EvilTokens AI system represented a notable evolution in phishing campaigns by automatically analyzing email accounts to identify the most likely fraud targets, moving beyond traditional 'spray and pray' approaches. The platform's low technical barrier to entry and subscription model enabled threat actors to operate phishing attacks at industrial scale.
Governance controls
Microsoft and its partners were able to dismantle the platform's infrastructure and arrest the operators, but the investigation revealed that the phishing network had already compromised thousands of organizations before being shut down.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.