Microsoft Dismantles EvilTokens Phishing Service with Global Reach

A notorious phishing service called EvilTokens has been disrupted by Microsoft and law enforcement in the UK. The service, which emerged in February, allowed criminals to bypass multi-factor authentication (MFA) and silently authenticate as victims to Microsoft 365 applications.

EvilTokens featured an AI chatbot that could analyze a victim's inbox and help criminals identify who to target, which trusted contacts to impersonate, and even which fraud strategies to use. The service was sold as-a-service and had already compromised over 12,000 email inboxes across more than 10,000 organizations worldwide.

Microsoft seized 50 websites used to operate the service and disabled over 150 additional domains tied to its supporting infrastructure. Two men, aged 32 and 38, were arrested by the Metropolitan Police Service on suspicion of acting as the administrators of the EvilTokens website. They have been released on bail while the investigation continues.