September 24, 2026
For years, cybersecurity professionals warned that artificial intelligence would eventually become a weapon in the hands of criminals. On September 22, 2026, that warning came into sharp focus when Microsoft announced the disruption of EvilTokens — a sophisticated phishing-as-a-service platform that used AI to compromise more than 12,000 corporate email inboxes across more than 10,000 organizations worldwide. The takedown, involving coordinated action from law enforcement, major tech companies, and financial intelligence firms, offers a disturbing preview of what AI-powered crime looks like at scale.
What Was EvilTokens?
EvilTokens was not a conventional phishing kit. It was a commercial cybercrime platform — a turnkey business for fraudsters — that subscribers could purchase with zero technical expertise required. Advertised openly on Telegram starting in February 2026, the service offered a menu of attack tools, including:
An Office 365 phishing capture link for $1,500 upfront plus $500 per month, business-to-business email senders starting at $600, and SMTP infrastructure and anti-bot redirectors.
What separated EvilTokens from the thousands of crude phishing kits circulating on dark web forums was its AI backbone. The platform included a built-in AI chatbot that could read compromised email accounts, map organizational hierarchies, identify wire-transfer discussions, flag high-value targets, and draft persuasive impersonation emails in multiple languages — all automatically. Evidence gathered by Microsoft and partners suggests large portions of the toolkit itself were developed using AI assistance, meaning criminals were using AI to build better AI-powered criminal tools.
The Device Code Trick
The technical heart of EvilTokens exploited a legitimate feature of the OAuth 2.0 protocol called device code authentication — a flow originally designed for devices that lack traditional keyboards, like smart TVs or printers, to authenticate with online accounts. In the intended use case, a user visits a URL on a phone or computer and enters a short code shown on their limited-interface device, completing authentication remotely.
EvilTokens weaponized this process with devastating efficiency. Victims received convincing phishing emails — drawn from 44 different templates including fake invoice requests, password expiration notices, and RFP forms. When victims clicked a link, background automation on EvilTokens’ servers silently requested a real device code from Microsoft’s authentication systems. The code was embedded in the phishing page, and victims who entered it on what appeared to be a routine Microsoft portal were actually handing criminals a fully valid authentication token — without ever entering their password.
Critically, this approach bypassed multi-factor authentication entirely. Because device code flows are designed to separate the device requesting authentication from the device completing it, the victim’s phone-based MFA approval never entered the picture. One click, and an attacker had persistent, authenticated access to an entire corporate email account.
AI as the Intelligence Layer
Once inside, EvilTokens’ AI capabilities kicked in. The platform’s integrated chatbot analyzed compromised inboxes at scale, performing tasks that would have required hours of manual work by a skilled human attacker:
Identifying payment authorities and executives with financial approval power, locating ongoing wire transfer discussions and pending invoices, mapping reporting structures within organizations to understand who trusted whom, and drafting fraudulent follow-up emails — impersonating executives or suppliers — calibrated to the victim’s actual communication style.
Microsoft’s security researchers noted that the AI analysis enabled threat actors to execute business email compromise fraud with a precision that previously required extensive manual reconnaissance. “The platform made the hard parts easy,” one security firm observed, “reading compromised mailboxes, identifying trusted relationships, and drafting the impersonation mail that follows.” From a criminal’s perspective, EvilTokens transformed labor-intensive financial fraud into an almost automated process.
To maintain access and evade detection, the platform also planted malicious inbox rules on compromised accounts — silently routing or deleting certain messages to hide the ongoing compromise from IT security teams and the account owner.
The Scale of the Damage
By the time Microsoft moved to shut EvilTokens down, the damage was extensive. SpyCloud, one of the companies involved in the disruption effort, identified over 8,700 unique compromised corporate accounts spanning more than 6,500 corporate email domains across 79 countries. Victims were concentrated in the United States, Canada, the United Kingdom, Australia, India, and France, with targeted industries including wholesale distribution, construction, financial services, real estate, higher education, and healthcare.
Cryptocurrency tracing firms working with Microsoft tracked approximately $1.1 million in revenue flowing through Storm-2992’s infrastructure between October 2025 and June 2026 — suggesting the service had been running profitably for nearly a year before its disruption.
Storm-2992 and the Arrests
Microsoft attributed EvilTokens to a threat group it designates Storm-2992, a criminal organization operating infrastructure across multiple countries. The group relied heavily on cloud platforms including Vercel, Cloudflare Workers, and AWS Lambda to blend phishing traffic with legitimate enterprise cloud traffic — a technique that made detection by standard network monitoring extremely difficult.
The legal response came swiftly once investigators had enough evidence. On September 11, 2026, London’s Metropolitan Police arrested two men, aged 32 and 38, in connection with the operation. Their identities were not publicly disclosed. Eleven days later, Microsoft’s Digital Crimes Unit, operating under authorization from the U.S. District Court for the Eastern District of Virginia, launched the coordinated infrastructure takedown.
The operation involved an unusually broad coalition: Cloudflare and Railway terminated hosting services, Coinbase blocked associated cryptocurrency accounts, OpenAI revoked API access, and threat intelligence firms SpyCloud, TRM Labs, and The Shadowserver Foundation contributed data and analysis. In total, 50 websites were seized, more than 150 additional domains were disabled, and hundreds of Cloudflare domains and Workers projects were banned.
The Broader Warning
The EvilTokens case is significant not just because of its scale, but because of what it illustrates about where cybercrime is heading. The platform represents a template: AI transforms financial fraud from a skilled-labor problem into an infrastructure problem. Criminals no longer need a team of experienced social engineers fluent in multiple languages; they need a subscription.
Security researchers noted that EvilTokens is believed to be the first phishing-as-a-service platform to implement device code phishing at scale, and that the AI-assisted post-compromise phase represented a meaningful leap in automation capability. If similar platforms follow the SaaS model to its logical conclusion, sophisticated business email compromise attacks — previously the domain of nation-state actors and organized criminal syndicates — could become a commodity available to anyone with a few thousand dollars and a Telegram account.
For defenders, the implications are significant. Multi-factor authentication, long considered a near-silver bullet for credential theft, provides no protection against device code phishing. Organizations need to disable device code authentication flows entirely where they are not operationally required, implement conditional access policies, and deploy behavioral detection systems capable of flagging anomalous OAuth activity before attackers use their stolen tokens to plant persistent access mechanisms.
The takedown of EvilTokens is a victory. But the template it established is almost certainly being replicated. The AI criminal has arrived — and next time, the service may not be so visible on Telegram.
