Microsoft Disrupts EvilTokens, a Powerful Phishing-As-A-Service Platform

Microsoft and its partners have disrupted EvilTokens, a phishing-as-a-service platform used by over 1,000 cybercriminals to compromise thousands of Microsoft customer email inboxes worldwide.

The service, which was launched in February 2026, used AI at every stage of the attack chain to target victims' sensitive information and facilitate financial fraud.

EvilTokens allowed its users to map organizational structures and permissions in Microsoft Graph, enabling them to bypass multi-factor authentication and other security measures.