Quick Answer
EvilTokens was an AI-enabled phishing service that Microsoft, Cloudflare, Health-ISAC, and law enforcement disrupted on September 22, 2026. Microsoft says the operation used device-code phishing to steal session tokens, exposing more than 12,000 inboxes. Organizations should revoke active sessions, investigate mailbox access, and train staff to verify unexpected Microsoft sign-in requests on any device.
Key Takeaways
- Microsoft linked EvilTokens to more than 12,000 compromised inboxes across over 10,000 organizations.
- EvilTokens used AI for inbox analysis, target selection, impersonation, and financial-fraud planning.
- The service relied on device-code phishing, which can steal usable session tokens without directly obtaining a password.
- Microsoft seized 50 EvilTokens websites and disabled more than 150 supporting domains.
- Password resets alone may not remove attacker access when stolen sessions and tokens remain active.
What was the EvilTokens AI phishing service?
EvilTokens was a cybercrime platform that combined phishing infrastructure with AI-assisted guidance for account compromise and financial fraud. Microsoft said the service analyzed compromised inboxes, selected targets, impersonated users, and helped attackers plan fraud involving business email and financial correspondence. Microsoft’s Digital Crimes Unit announcement describes the operation as an AI chatbot built to support cybercrime.
EvilTokens matters because the platform appears to have reduced the expertise needed to conduct convincing phishing campaigns. A criminal who already has access to a mailbox can use existing messages, invoice threads, names, and business relationships to make a fraudulent request appear routine. That creates a more serious risk than a generic spam message because the recipient may recognize the sender, project, or payment context.
Microsoft said EvilTokens had been linked to more than 12,000 compromised inboxes across more than 10,000 organizations worldwide within months of its February 2026 launch. The reported scale does not establish that every affected inbox led to financial loss, but it shows that the service reached beyond isolated, opportunistic phishing attempts. Organizations should treat an unexpected sign-in prompt or payment request as a security event when it arrives in an otherwise legitimate email conversation.
How did EvilTokens use device-code phishing?
EvilTokens used device-code phishing to persuade victims to complete a legitimate Microsoft sign-in process that benefited the attacker. Microsoft says the victim could enter a code and authenticate through a real Microsoft page, while the attacker obtained a session token that allowed access to the account. Microsoft Threat Intelligence’s technical analysis explains that the service used this method to gain persistent access and extract mailbox data.
A session token is proof that a user has already authenticated. The practical risk is that a password reset may not end the intrusion if the attacker still holds a valid token or active session. EvilTokens could use stolen tokens for mailbox exfiltration, meaning the removal of email contents, and continued account access.
Device-code authentication has legitimate uses, including signing into devices that have limited input options. The danger arises when a criminal controls the code request and convinces a victim to enter it. Employees should stop and verify the request through a known company contact or internal support channel before entering a code that they did not initiate themselves.
Why did AI make EvilTokens more dangerous?
EvilTokens made phishing more dangerous because AI could help criminals interpret stolen communications and prepare tailored fraud attempts more quickly. Microsoft said the platform used AI throughout attacks, including compromised-inbox analysis, target selection, impersonation, and financial-fraud planning. The platform reportedly offered 44 lure themes, including invoices, requests for proposals, and shared files.
Cloudflare said EvilTokens used Cloudflare Workers and offered an AI coach that advised criminals on US tax documents, business-email compromise, invoice correspondence, and accounting communications. Cloudflare’s account of the disruption shows how the service paired hosting infrastructure with advice intended to make social-engineering messages more credible.
AI does not make every phishing email convincing or technically sophisticated. The platform still depended on victims approving a sign-in flow, trusting a message, or failing to verify a payment-related request. The most sensible response is to build verification into normal financial workflows, especially when an email changes bank details, requests a payment, or asks a recipient to sign in through an unfamiliar process.
Businesses already face related risks from fraudulent pages and manipulated account messages. Recent scam shell page removals show that large platforms continue to remove infrastructure used to support deceptive campaigns, but removal after discovery cannot replace careful review before a user approves a login or payment.
What did Microsoft and its partners disrupt?
Microsoft and its partners disrupted a significant portion of EvilTokens’ online infrastructure on September 22, 2026. Microsoft said it seized 50 EvilTokens websites and disabled more than 150 domains that supported the operation. The disruption can make a criminal service harder to access and operate, but it does not automatically remove stolen data or invalidate tokens that attackers collected before the takedown.
Microsoft and Health-ISAC filed a lawsuit in the US District Court for the Eastern District of Virginia against Felix Utomi, Waidi Segun Adams, and unnamed defendants. The case is numbered 1:26-cv-3047. Microsoft also said UK Metropolitan Police cybercrime officers arrested two men, ages 32 and 38, on September 11 in connection with the alleged operation, and both men were released on conditional bail.
The legal and technical actions matter because phishing services often rely on multiple websites, domains, hosting tools, and payment systems. Removing a portion of that structure can interrupt active campaigns and provide investigators with evidence. At the same time, organizations should not assume that a public takedown means earlier compromises have been resolved. Security teams should review sign-in records and mailbox activity for accounts that received suspicious device-code requests.
Which EvilTokens warning signs should organizations watch for?
EvilTokens warning signs include unexpected device-code requests, urgent invoice messages, requests for proposals that contain unfamiliar sign-in links, and shared-file notices that require a recipient to authenticate. Microsoft identified invoices, requests for proposals, and shared files among the 44 lure themes used by the platform. The important distinction is context: a familiar-looking message can still be malicious when the requested login action is unexpected.
| Warning sign | Why it creates risk | Safe response |
|---|---|---|
| An unrequested device code or sign-in prompt | An attacker may be attempting to obtain a session token through a legitimate authentication page. | Do not enter the code. Verify the request through a known support or security contact. |
| An invoice or payment change in an existing thread | A compromised mailbox can make fraudulent financial messages appear credible. | Confirm payment details using a known phone number or established business process. |
| A shared-file notice requiring an unfamiliar login | Shared files were one of EvilTokens’ reported lure themes. | Open the service directly from a saved bookmark or approved work portal instead. |
| Unexpected mailbox rules or unfamiliar sessions | Attackers may use ongoing mailbox access to monitor messages or hide activity. | Report the account immediately and begin an access review. |
Organizations should also consider suspicious mailbox behavior after a successful phishing event. New forwarding rules, deleted messages, unfamiliar sent mail, and repeated sign-in prompts can indicate that an attacker is maintaining access. A stolen credential is dangerous, but a stolen active session can be equally important because it may let an attacker continue operating after a password change.
What should a user do after a suspected EvilTokens compromise?
A user who suspects an EvilTokens-style compromise should report the account immediately and revoke active sessions and tokens, not only change the password. Microsoft specifically warned that a token obtained through device-code phishing can remain useful after a password reset unless the organization also revokes the relevant sessions and tokens. The appropriate steps depend on the organization’s identity system, so users should involve their IT or security team rather than attempting to investigate a work account alone.
- Stop interacting with the suspicious email, shared-file request, or sign-in page.
- Report the suspected compromise through the organization’s established security or IT channel.
- Change the account password through the official account portal after reporting the incident.
- Revoke active sessions and authentication tokens through the organization’s identity administration process.
- Review mailbox rules, forwarding settings, recent sign-ins, and sent messages with the security team.
- Warn internal contacts if the compromised account may have sent fraudulent requests.
Personal users should use the official account recovery and security pages for the affected service, rather than links from the suspicious message. The same principle applies to cryptocurrency and finance-related phishing, where a fraudulent login can lead to irreversible losses. The Trezor phishing incident illustrates why an email that appears connected to a legitimate company still requires independent verification.
Stop and contact an organization’s security team or the account provider if unfamiliar sessions return after revocation, mailbox rules reappear, or the account sends messages that the user did not write. Continued activity can indicate that the attacker retains another access path, and repeated DIY changes may make forensic review more difficult.
How should organizations reduce AI phishing risk?
Organizations can reduce AI phishing risk by requiring independent verification for authentication and financial actions, monitoring sign-in and mailbox activity, and ensuring staff know that a legitimate sign-in page can still be part of a fraud attempt. EvilTokens shows that the central security question is not only whether an email contains poor grammar or an obvious malicious attachment. A polished message can still be fraudulent when its request is inconsistent with normal work procedures.
Security teams should make reporting simple and clearly communicate which sign-in prompts employees are expected to receive. A user who knows that a device-code request is unusual for a particular job is more likely to pause before entering a code. Teams should also define who can approve payment-detail changes and require an out-of-band confirmation method for high-risk requests.
Organizations should keep their response plans current because phishing campaigns can use AI to adapt messages to their target. The rise of fake AI trading malware also demonstrates that attackers use AI branding and AI-related interest to make harmful tools appear legitimate. Staff training should therefore cover both AI-assisted impersonation and fraudulent products that claim to offer AI capabilities.
The practical goal is not to make employees responsible for stopping every attack alone. Security controls, account monitoring, clear escalation paths, and payment verification procedures reduce the consequences when a convincing message reaches an inbox. Organizations that detect a suspected compromise should preserve relevant evidence and work with their security provider, legal team, or law enforcement when the incident involves sensitive data or attempted financial theft.
FAQ
What is EvilTokens?
EvilTokens was an AI-enabled cybercrime service that supported phishing, compromised-inbox analysis, impersonation, and financial-fraud planning. Microsoft said the service was linked to more than 12,000 compromised inboxes across more than 10,000 organizations worldwide.
Did Microsoft shut down EvilTokens?
Microsoft disrupted EvilTokens on September 22, 2026, with Cloudflare, Health-ISAC, and law enforcement support. Microsoft said the action seized 50 websites and disabled more than 150 domains connected to the operation.
Can a password reset stop device-code phishing?
No, a password reset alone may not stop device-code phishing when an attacker has already obtained a usable session token. Microsoft says organizations must also revoke active sessions and tokens to remove that form of access.
What should I do if I entered an unexpected Microsoft device code?
A user who entered an unexpected Microsoft device code should report the incident immediately, change the account password through the official portal, and ask the organization to revoke active sessions. Work-account users should involve IT or security because mailbox and sign-in logs may need review.
How can I recognize an EvilTokens-style phishing message?
An EvilTokens-style phishing message can use invoices, requests for proposals, or shared-file notices to prompt an unexpected sign-in. Verify the request through a known contact or approved company process before entering a code, opening a file, or changing payment details.