Microsoft Tackles EvilTokens Cybercrime Service with Court-Backed Operation

Microsoft recently took down the EvilTokens cybercrime service through a court-authorized operation with law enforcement and industry partners. The disruption removed 50 websites and disabled more than 150 related domains.

EvilTokens compromised over 12,000 inboxes across 10,000 organizations, using AI to sift through stolen email for payment conversations and people worth impersonating.

The company says its goal is to prevent attackers from turning trusted inboxes into fraud tools. The takedown removed infrastructure, but the bigger test is whether stronger account protection can stop attacks before they occur.