Microsoft Disrupts AI-Powered Phishing Service Compromising Thousands of Email Inboxes

Microsoft's Digital Crimes Unit took down EvilTokens, an AI-powered phishing service that compromised over 12,000 email inboxes across more than 10,000 organizations. The service was launched in February 2026 and quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms.

EvilTokens tricked targets into entering authentication codes on Microsoft's sign-in page, allowing the attackers to collect session data without ever seeing a password. Once inside an account, the AI assistant ran across the contents, summarizing and translating messages, surfacing financial conversations, and flagging trusted relationships worth impersonating.

Microsoft seized 50 websites used to operate the service and disabled over 150 additional domains tied to its supporting infrastructure. The company also notified affected customers and shared intelligence with partners. Security teams are advised to revoke active sessions and refresh tokens rather than resetting passwords alone, as this may not prevent token theft.