The short answer
Microsoft’s Digital Crimes Unit dismantled EvilTokens, a subscription service that bundled account takeover, AI-driven mailbox analysis, and payment-fraud tooling into one product — and it was linked to 12,000+ compromised inboxes across 10,000+ organizations. The takedown, backed by a court order in the Eastern District of Virginia, seized 50 sites and 150+ supporting domains; UK police arrested two suspects. The most important detail for defenders is how it worked: device-code phishing that bypassed multi-factor authentication, then an AI chatbot that turned each stolen inbox into ready-made business email compromise attacks.
The lesson is not “phishing is back.” It is that AI has collapsed the skill and time needed to run BEC. Reconnaissance, target selection, and impersonation — the parts that used to need a patient human — are now automated. If your identity setup still leans on password + MFA and treats email as trusted once someone signs in, this is the campaign that walks through it.
What Microsoft announced — and why it matters
Microsoft said its Digital Crimes Unit, acting on an order from the U.S. District Court for the Eastern District of Virginia, seized 50 websites used to operate EvilTokens and, working with industry and law-enforcement partners, took down more than 150 additional domains tied to the platform’s infrastructure. Microsoft tracks the operation as Storm-2992 and linked it to over 12,000 compromised inboxes across more than 10,000 organizations. The UK’s Metropolitan Police arrested two men, aged 32 and 38, on September 11 in connection with the service.
What makes EvilTokens notable is that it was a product, not a one-off campaign. Launched in February 2026 and sold on Telegram for a $1,500 setup fee plus $500 a month, it packaged account compromise, AI mailbox analysis, and fraud tooling into a single subscription — the same commoditization that turned ransomware into “ransomware-as-a-service.” Investigators traced roughly $1.1 million in cryptocurrency revenue, and Microsoft says the disruption was coordinated with Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, the Shadowserver Foundation, and TRM Labs.
The victim spread is a warning for mid-market companies specifically. Microsoft said impact was concentrated in the United States, Canada, the United Kingdom, Australia, India, and France, hitting sectors from distribution and construction to financial services and healthcare. These are exactly the organizations that run real money through email — invoices, wire instructions, purchase orders — but often lack a dedicated identity or FinTech-grade fraud team. That is the gap EvilTokens was built to monetize.
How device-code phishing beats MFA
The technique at the core of EvilTokens abuses the OAuth 2.0 device authorization flow — the legitimate mechanism that lets you sign a smart TV or CLI into your account by typing a short code on a phone. A phishing lure (an invoice, an RFP, a shared file) leads the target to a page that, in the background, asks Microsoft’s identity provider for a live device code. The victim is prompted to enter that code on the real microsoft.com/devicelogin page and to complete their normal sign-in, including MFA.
Here is the trap: because the code belongs to the attacker’s session, the identity provider issues the access and refresh tokens to the attacker, not to the victim. The user did everything right — genuine site, genuine MFA prompt — and still handed over an authenticated session. Standard MFA does not help, because the challenge was real; it simply authorized the wrong client. Worse, the stolen refresh token grants continued access even after a password change, until the session or token is explicitly revoked.
Then the AI does the rest. Microsoft describes an AI chatbot that, once inside a mailbox, identified finance and executive contacts, surfaced threads about wire transfers and outstanding invoices, and drafted messages impersonating trusted parties to redirect payments. The reconnaissance and writing that a skilled BEC operator used to do by hand — learning the org chart, matching tone, timing the ask — is now generated on demand. That is what “AI-powered” means here: not smarter malware, but industrialized social engineering.
What it means for US & EU software teams
The first shift is that MFA can no longer be the finish line of your identity story. Device-code and consent-phishing steal tokens after a legitimate MFA check, so the controls that matter now sit around the token: whether the device-code flow is even allowed, how long sessions live, and how fast you can revoke. If you build or operate software for others, this is also a product question — the same secure-by-default identity choices belong in the custom software you ship, not just in your corporate tenant.
The second shift is payment integrity as an engineered control, not a policy PDF. BEC succeeds at the moment a human trusts an email enough to change bank details or release a wire. In regulated sectors — FinTech, HealthTech, anything touching GDPR, SOC 2, or the EU AI Act — that trust needs to be backed by out-of-band verification, dual approval on payment changes, and an audit trail. A workflow that lets one convincing email reroute money is a design flaw, however good your training deck is.
The third shift is detection tuned for identity, not just endpoints. The signals that catch this class of attack are anomalous token issuance, sign-ins from unexpected clients, impossible-travel patterns, and new inbox rules that hide replies. Those live in your identity and email logs, and they are noisy without engineering. Standing up that monitoring — and rehearsing revocation — is the kind of work we fold into cloud and DevOps hardening so that a stolen token triggers an alert in minutes, not a forensic report in weeks.
What to do now
- Lock down the device-code flow. Block or scope it with conditional access; allow it only for the specific devices or apps that truly need it. For most user populations it can be off entirely.
- Move toward phishing-resistant auth. Passkeys and FIDO2 defeat the whole class of “trick the user into an MFA prompt” attacks. Prioritize finance, executive, and admin accounts first.
- Shorten and revoke. Reduce token lifetimes, enable continuous access evaluation where available, and make token/session revocation a one-click runbook, not a ticket.
- Verify money out of band. Require a second channel and dual approval for any change to bank details or wire instructions. Treat email-only requests as unverified by default.
- Test the real attack. Run security audits and phishing simulations that cover device-code and consent-based flows — not just link-click awareness — and monitor identity logs for anomalous token issuance.
Frequently asked questions
What is EvilTokens and what did Microsoft do on September 22, 2026?
EvilTokens was an AI-powered phishing-as-a-service platform, tracked by Microsoft as Storm-2992, that packaged account compromise, AI mailbox analysis, and fraud tooling into one subscription. On September 22, 2026, Microsoft’s Digital Crimes Unit, acting on an order from the U.S. District Court for the Eastern District of Virginia, seized 50 websites and, with partners, took down 150+ more domains. The platform was linked to over 12,000 compromised inboxes across more than 10,000 organizations.
How did EvilTokens bypass multi-factor authentication?
It abused the OAuth 2.0 device authorization (device-code) flow. A phishing lure led the victim to enter a live device code on the genuine microsoft.com/devicelogin page. When the victim completed their own sign-in, including MFA, the identity provider issued access and refresh tokens to the attacker’s client. Because the MFA challenge was real, standard MFA did not stop the theft, and the stolen refresh token could grant access until the session or token was revoked.
What did the AI component actually do?
Once an inbox was compromised, an AI chatbot analyzed the mailbox to identify finance and executive contacts, surface conversations about wire transfers and outstanding invoices, and draft messages impersonating trusted contacts to redirect payments. It automated the reconnaissance and social-engineering steps of business email compromise that previously required a skilled human operator.
Who was affected and how much did it cost victims?
Microsoft said victims were concentrated in the United States, Canada, the United Kingdom, Australia, India, and France, spanning sectors from distribution and construction to financial services and healthcare. Investigators traced roughly $1.1 million in cryptocurrency revenue to the operation, and UK police arrested two men, aged 32 and 38, on September 11, 2026.
What should US and EU teams do to defend against device-code phishing?
Block or tightly restrict the device-code flow with conditional access, move toward phishing-resistant authentication such as passkeys or FIDO2, shorten token lifetimes and enable rapid revocation, and monitor for anomalous token issuance and impossible-travel sign-ins. For payments, require out-of-band verification of any change to bank details, and run security audits and phishing simulations that specifically cover device-code and consent-based attacks.
Sources
Microsoft On the Issues — Disrupting EvilTokens: The AI Chatbot Built for Cybercrime (company announcement)
The Hacker News — Microsoft Takes Down EvilTokens Device-Code Phishing Service
Help Net Security — Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes