Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes
The EvilTokens phishing service, which compromised more than 12,000 inboxes at over 10,000 organizations, has been disrupted by a coalition of law enforcement and private-sector partners led by Microsoft.
With authorization from the US District Court for the Eastern District of Virginia, Microsoft and Health-ISAC worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs to seize 50 websites used to operate the service and disable more than 150 domains tied to its infrastructure.
Seizure notice (Microsoft)
Microsoft notified affected customers, helped them remediate compromised accounts and shared intelligence to support further investigation.
“No single organization could disrupt EvilTokens alone. The service relied on hosting providers, cloud services, AI tools, financial services, and other online resources that cybercriminals repurposed to support fraud at scale,” said Steven Masada, Associate General Counsel and GM, Microsoft’s Digital Crimes Unit.
On September 11, 2026, officers from the Metropolitan Police Service’s cybercrime team arrested two men, aged 32 and 38, on suspicion of offenses connected with the alleged operation of EvilTokens. Both men have been released on police bail subject to conditions while the investigation continues.
AI chatbot that read victims’ email
Launched in February 2026, the service gave criminals access to email accounts along with an AI chatbot that analyzed what they found inside.
Victims were tricked into entering an authentication code on Microsoft’s legitimate sign-in page. By completing this normal step, they unknowingly handed over access without revealing their passwords.
“That access could persist even after a password reset if the associated sessions and tokens were not also revoked,” Masada noted.
Once inside a mailbox, the service’s AI tools could summarize and translate emails, surface financial conversations, map roles within the organization and identify trusted relationships. Preset prompts offered to find wire transfer discussions, locate vendor invoices, identify the organization’s “money movers” and determine the best people to impersonate. The platform could also draft messages posing as trusted contacts.
The AI “helped them decide who to target, who to impersonate,” Masada added.
Microsoft observed the highest concentrations of victim activity in the US, Canada, the UK, Australia, India and France. Affected organizations ranged from wholesale distribution and construction to financial services, higher education and healthcare.
“Sold through Telegram for a $1,500 initiation fee and a recurring $500 subscription, EvilTokens combined account compromise, mailbox analysis, target selection, and fraud preparation in a single service. Capabilities that once required experience across identity attacks, cloud systems, social engineering, and financial fraud were available through a ready-made interface,” Masada wrote.
Microsoft investigators used reverse engineering and AI-powered tools to analyze evidence and identify the infrastructure supporting the service.
“The infrastructure supporting EvilTokens has been disrupted, but the model it demonstrated will not disappear with it,” said Masada. “EvilTokens offers an early example of how those capabilities can be combined with compromised accounts to accelerate financial fraud.”
He advised organizations to assume that once an inbox is compromised, criminals “may understand its contents in minutes.”
“Strong identity protections and monitoring remain essential, but organizations should also independently verify requests to change payment information, redirect funds, or approve unusual transactions through a trusted second channel,” Masada concluded.
