EvilTokens: the phishing service that let AI run the fraud

On September 22, Microsoft's Digital Crimes Unit announced it had disrupted EvilTokens, a phishing-as-a-service platform that paired device-code phishing with an AI chatbot. The AI was not a garnish. It was the product.

Within months of launching in February 2026, EvilTokens was linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide, Microsoft said. Victim activity concentrated in the US, Canada, the UK, Australia, India, and France. Sectors ranged from wholesale distribution and construction to financial services, real estate, higher education, and healthcare. Access sold through Telegram for a $1,500 initiation fee plus a $500 monthly subscription.

The sign-in page was real

EvilTokens did not fake Microsoft's login. Victims were tricked into entering an authentication code on Microsoft's legitimate sign-in page. They completed the normal process, including multi-factor authentication, and handed the attacker's session a valid set of access and refresh tokens. No password was stolen. Nothing was bypassed.

Here is the sentence your help desk should read twice. Microsoft says that access could persist even after a password reset, if the associated sessions and tokens were not also revoked. A password reset changes the secret. The tokens were issued under a valid session, and they do not die with it.

Once inside, the AI did the work that used to require a skilled operator. Microsoft says the service's chatbot could summarize and translate emails, surface financial conversations, map organizational roles, and identify trusted relationships. Preset prompts found wire-transfer discussions, located vendor invoices, identified the organization's "money movers," and picked the best people to impersonate. The platform could recommend fraud strategies and draft the impersonation messages.

As Steven Masada, the DCU's associate general counsel, put it: AI did not just help attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to extract the most money.

The takedown

Under authorization from the US District Court for the Eastern District of Virginia, Microsoft and Health-ISAC worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, the Shadowserver Foundation, and TRM Labs to seize 50 websites and disable more than 150 additional domains. Press reports date the court order to September 15. On September 11, officers from the Metropolitan Police Service's cybercrime team arrested two men, aged 32 and 38, in connection with the alleged operation; both have been released on bail.

Microsoft tracks the operators as Storm-2992. This was the DCU's 40th court-authorized disruption, and its first aimed at an end-to-end AI-enabled cybercrime service. Microsoft also says investigators found large portions of EvilTokens "vibe coded," built with AI assistance and drawing on capabilities from multiple AI models. The partner list reads like a cross-section of the internet the service abused: hosting, crypto, and AI providers side by side.

Every number above comes from Microsoft's own account of an action it ran. Treat it as that. But the structural facts are what matter, and they do not depend on Microsoft's telling: the technique is a legitimate authentication flow, the tokens outlive password resets, and the AI turned mailbox access into fraud faster than any human operator could.

What to do this week

If you run a Microsoft 365 tenant, the checklist is short.

Audit device-code authentication sessions in your sign-in logs. Look for authorizations no one can explain: a device-code sign-in for a user who never owns a TV, printer, or CLI workflow. If you find compromise, revoke sessions and tokens, not just passwords. Microsoft says the access could persist after a password reset "if the associated sessions and tokens were not also revoked" — in Entra, Revoke-SignInSessions is the step that matters; the password reset alone changes nothing the attacker holds.

Review OAuth consent grants while you are in there. Attackers also register new devices and set malicious inbox rules to hide their presence, per Microsoft's threat-intelligence reporting. And consider blocking the device-code flow with Conditional Access wherever it is not needed, keeping documented exceptions tight.

Finally, the payment step. Microsoft advises independently verifying requests to change payment information, redirect funds, or approve unusual transactions through a trusted second channel. Assume that once an inbox is compromised, criminals may understand its contents in minutes, not days.

The agent-harness lesson

Strip out the fraud and EvilTokens reads like an agent-harness pitch deck. It ingested mailbox context, mapped relationships, ranked targets by expected value, and drafted the outreach. Subscription pricing, a management dashboard, customer support, preset prompts. The crimeware economy is not waiting for agentic AI to mature. It has already packaged the agent loop as a monthly plan.

That is why this story belongs with the recent open-source agents that breached 27 companies and the llms.txt prompt-injection wave. The throughline is one tool pattern: read context, decide, act. Every time that pattern ships in a legitimate harness, a version of it ships in crimeware too. Builders who only threat-model the intrusion step are missing the part that now scales.

Unknowns

Microsoft did not name the two men arrested; they are on bail, not convicted, and this article will not name them either.

Update, September 29: The names are now public. The September 15 civil complaint filed in the Eastern District of Virginia by Microsoft and Health-ISAC names UK residents Felix Utomi and Waidi Segun Adams as defendants, alleging both had access to EvilTokens' source code, its control panels, and the Telegram accounts used to sell it, as reported by CyberScoop and SecurityWeek. Allegations are not convictions: both men are free on police bail while the Metropolitan Police investigation continues, and the complaint also names five defendants anonymously. The blog gives no technical detail on how the chatbot chose its models or prompts. The takedown removed infrastructure, not the technique. Device-code phishing still works wherever the flow is enabled, and the people who bought EvilTokens subscriptions keep the tradecraft.