Microsoft just took down one of the biggest AI-powered phishing operations discovered so far. It was called EvilTokens, and it had already broken into more than 12,000 email inboxes before it got shut down. Here is what actually happened, and more importantly, how to make sure you do not become the next victim of something similar.
Quick Answer
- EvilTokens was an AI-powered phishing tool that criminals could rent as a subscription, like renting software
- It compromised over 12,000 email inboxes across more than 10,000 companies worldwide
- Microsoft shut it down on September 22, 2026, working with Cloudflare, Coinbase, OpenAI, and several other companies
- Two men were arrested in the UK in connection with running it
- It worked through a trick called device code phishing, which does not need your password at all
- You can protect yourself with a couple of simple habits, covered below
What Was EvilTokens
EvilTokens was not run by a single hacker. It was sold as a subscription service, priced at $500 a month or $1,500 as a one-time payment, available to anyone willing to pay for it through Telegram. Whoever bought it got access to dozens of ready-made phishing kits, along with AI tools built into the service itself.
That AI did two things. It read through inboxes that were already compromised to figure out which contacts and conversations looked most valuable to impersonate, and it helped write convincing fake emails based on what it found. In short, it made phishing attacks cheaper, faster, and much harder to spot, without the attacker needing any real skill of their own.
How Did It Actually Trick People
This is the part worth understanding, because it does not work the way most people expect phishing to work. EvilTokens did not need to steal your password.
It abused something called device code sign-in, a real, legitimate feature built into Microsoft accounts. Normally, this feature exists so you can sign into your Microsoft account on a device that does not have a keyboard easily available, like a smart TV or certain office equipment. You go to a website, enter a short code, and your account signs in on that other device, without typing your password there.
Attackers using EvilTokens would send a message asking a target to enter a code, often disguised as something routine, like a meeting invite or a document that needed approval. If the person entered that code, they had unknowingly handed the attacker access to their own account, without ever typing in a password anywhere suspicious. This is exactly why the attack was so effective. It did not look like a typical phishing attempt at all.
How Big Was the Damage
The numbers give a sense of the scale:
- Over 12,000 email inboxes compromised
- More than 10,000 organizations affected worldwide
- Industries hit included finance, healthcare, education, real estate, and construction
- Roughly $1.1 million in criminal revenue was traced through cryptocurrency payments
How Microsoft Shut It Down
On September 22, 2026, Microsoft’s Digital Crimes Unit, working with court authorization in the United States, led a coordinated takedown alongside several other companies, including Cloudflare, Coinbase, OpenAI, and security firm SpyCloud. Together, they seized 50 websites and disabled more than 150 additional domains that were keeping the service running.
Separately, UK police had already arrested two men, aged 32 and 38, on September 11, in connection with running the service’s technical backend. Both were released on bail while the investigation continues.
This was notable for another reason too. It marks the first time Microsoft’s Digital Crimes Unit has taken legal action specifically against a criminal tool built around AI from the ground up, rather than a more traditional hacking tool that simply happened to use some AI features.
How to Protect Yourself From This Kind of Attack
Since this attack works differently from typical phishing, the usual advice of “don’t click suspicious links” does not fully cover it. Here is what actually helps:
- Be suspicious of any request to enter a code somewhere, especially if you were not the one who started that sign-in process. If you did not personally try to log in on a new device, do not enter a code someone else sends you.
- Question urgency. Messages asking you to quickly approve something, verify a document, or join an urgent meeting are common bait for this exact trick.
- Turn on multi-factor authentication through an authenticator app rather than text messages where possible, and keep a close eye on sign-in notifications from your accounts.
- If something feels off, verify separately. Call or message the person directly through a different channel instead of replying to the original email, especially for anything involving approvals or sign-ins.
- For businesses, restricting or monitoring device code sign-in through admin settings is worth discussing with your IT team, since most regular employees rarely need this feature at all.
Frequently Asked Questions
What is EvilTokens?
EvilTokens was an AI-powered phishing service that criminals could rent as a subscription, used to compromise over 12,000 email inboxes across more than 10,000 organizations before it was shut down by Microsoft in September 2026.
How did EvilTokens actually steal access to accounts?
It used a technique called device code phishing, tricking victims into entering a legitimate Microsoft sign-in code that unknowingly handed their account access to the attacker, without ever stealing a password directly.
Who shut down EvilTokens?
Microsoft’s Digital Crimes Unit led the takedown, working alongside Cloudflare, Coinbase, OpenAI, SpyCloud, and other partners, with UK police arresting two suspects connected to running the service.
Was I affected if I use Microsoft services?
Only if you personally entered a device sign-in code from a suspicious message. If you have not done that, you are not automatically affected. If you are ever unsure, check your account’s recent sign-in activity for anything unfamiliar.
How is this different from normal phishing?
Normal phishing usually tries to steal your password directly through a fake login page. This method instead tricks you into approving a real sign-in code, which does not require your password at all and can feel far less suspicious.
Is EvilTokens completely gone now?
Microsoft seized the core infrastructure running the service and two operators were arrested, but investigators have noted that similar criminal services sometimes attempt to resurface under a different name after a takedown like this.
Should regular, non-business users worry about this?
Anyone with a Microsoft account is a potential target, not just large companies, since phishing campaigns often start broad. The device code habit covered above is worth following regardless of whether you use Microsoft for work or personal use.
