Microsoft dismantles AI-powered EvilTokens phishing service behind 12,000 email breaches
Cybercrime platform used AI to automate business email compromise at scale across 10,000 organizations.
1AI-driven cybercrime platform
EvilTokens combined device-code phishing with AI-powered mailbox analysis, fraud strategy recommendations, and automated email drafting. The service used machine learning to identify payment authorizations, trusted relationships, and optimal fraud targets within compromised inboxes. Microsoft's Digital Crimes Unit found the platform could even generate impersonation messages mimicking legitimate contacts. This turnkey solution lowered the skill barrier for executing sophisticated business email compromise (BEC) attacks.
2Global impact and takedown
The service compromised 12,000 email inboxes across 10,000 organizations worldwide, with concentrated victims in the US, Canada, UK, Australia, India and France. Microsoft's court-authorized operation seized 50 websites and disabled 150 supporting domains. Law enforcement arrested two suspects in London. Partner organizations like Coinbase traced $1.1 million in platform revenue through cryptocurrency transactions between October 2025 and June 2026.
3Technical attack mechanism
EvilTokens abused OAuth 2.0 device authorization flows to obtain authenticated sessions without credentials. Victims entered codes at legitimate Microsoft login pages, unknowingly granting persistent access. Attackers then set malicious inbox rules to hide activity. The service bypassed security through multi-stage delivery pipelines using serverless platforms like Vercel and AWS Lambda, blending with legitimate cloud traffic to evade detection.
4Commercial cybercrime model
Operated as phishing-as-a-service (PhaaS) on Telegram since February 2026, EvilTokens offered tiered pricing: $1,500 lifetime access plus $500 monthly for API keys and phishing kits. The platform included management dashboards, customer support, and auxiliary tools like Antibot redirector and SMTP Sender. TRM Labs identified over 1,000 cryptocurrency deposits from 700 unique addresses funding the operation.
5AI's role in scaling attacks
The platform automated previously manual BEC components - analyzing inboxes in 20+ languages, identifying financial threads, and drafting targeted emails. SpyCloud recovered data showing 8,708 victim accounts across 6,585 corporate domains in 79 countries. Microsoft noted large portions of the toolkit were AI-developed, demonstrating how the technology lowers barriers for aspiring cybercriminals.
6Targeted industries and tactics
Victims spanned wholesale distribution, construction, financial services, real estate, education and healthcare. Attackers used 44 email themes including invoices and RFPs, with malicious URLs, PDFs and HTML attachments. The service provided phishing templates and preset prompts to locate vendor invoices, money movers, and ideal impersonation targets within organizations.
7Persistent access challenges
Unlike credential-based compromises, EvilTokens' token-based access persisted through password resets unless specific sessions were revoked. Microsoft emphasized this created ongoing risks even after initial detection. The platform's architecture allowed attackers to maintain long-term access through alternative pathways like granting new device permissions to compromised accounts.
8Industry collaboration significance
The takedown required coordinated action across hosting providers, exchanges, and data holders. Health-ISAC, Cloudflare, OpenAI and others contributed technical intelligence. This case establishes precedent for disrupting PhaaS ecosystems and highlights the urgent need for improved OAuth monitoring and token revocation capabilities in enterprise environments.