EvilTokens rented an AI-powered inbox-scanning tool and a device-code MFA bypass for a $1,500 fee plus $500 a month

"AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible," Steven Masada, associate general counsel and general manager of Microsoft's Digital Crimes Unit, wrote in a blog post.

Microsoft and industry partners disrupted EvilTokens, a cybercrime platform investigators linked to more than 12,000 compromised Microsoft customer email inboxes across more than 10,000 organizations globally; Microsoft announced it Tuesday.

EvilTokens launched in February 2026.

The platform can search messages for wire-transfer information, pending invoices and executive correspondence, then generate contextually relevant business email compromise messages.

EvilTokens specializes in device-code phishing, a technique that abuses the device-code authentication flow to obtain authentication tokens despite MFA protections, allowing attackers to compromise accounts without needing credential theft.

EvilTokens abuses Microsoft's legitimate OAuth 2.0 device-authorization flow, which is designed for devices with limited input capabilities such as smart TVs, printers, conferencing equipment and some Teams devices.

Victims of EvilTokens were largely concentrated in the United States, Canada, the United Kingdom, Australia, India and France, according to Microsoft.

A device code phishing attack starts with the attacker initiating a device-code request and sending the received code to a target as part of a phishing lure; the victim is directed to a page displaying the code and a button that links to Microsoft's legitimate login portal, where they are prompted to authenticate.

SpyCloud's dataset shows the most targeted countries are the United States, followed by Canada, Australia, the United Kingdom, and Saudi Arabia.

Microsoft attributes the development and support of the platform to Storm-2992, a threat actor unaffiliated with any other known cybercrime group, and says it identified two men behind EvilTokens.

Coinbase said it traced about $1.1 million in revenue for EvilTokens from its paying customers, and its threat researchers found more than 1,000 deposits to EvilTokens from more than 700 distinct addresses through June 2026.

Add-ons such as anti-bot redirectors, B2B and SMTP sending tools, and an Office 365 capture-link tool were sold separately, and the service provides 44 customizable phishing kits.

About 1,000 cybercriminals used EvilTokens over the course of its operation, a Microsoft spokesperson told CyberScoop.

Microsoft says campaigns using the EvilTokens platform impacted organizations in wholesale distribution, construction, financial services, real estate, higher education and healthcare sectors.

"We cannot estimate the total fraud attributable to all EvilTokens activity. However, we were able to correlate at least 13 complaints filed with the FBI's Internet Crime Complaint Center to EvilTokens-linked activity, representing approximately $1.7 million in reported losses," a Microsoft spokesperson said. "Because many incidents go unreported and not all victims can be definitively linked to specific campaigns, we believe this is a conservative estimate."

Others involved in the EvilTokens takedown included Health-ISAC, Cloudflare, OpenAI, Shadowserver and TRM Labs, alongside SpyCloud and Coinbase.

SpyCloud's recaptured phished data shows more than 8,708 compromised accounts across 6,585 corporate email domains in 79 countries.

SpyCloud's dataset shows roughly 97.5% of compromised accounts belonged to enterprise domains.

Device code phishing surged this year as multiple threat actors adopted the method, and by April there were at least 10 phishing platforms supporting the capability.

"The Met remains committed to holding people to account who facilitate criminal enabling functions and think they can remain undetected. We will find you and take action," Detective Inspector Serena D'Adamo told BleepingComputer.

At the advertised rates, a year of EvilTokens access cost $7,500.

Coinbase's traced revenue works out to under $1,100 per deposit on average.

The 13 IC3 complaints Microsoft correlated to EvilTokens average about $131,000 in reported losses each.

Microsoft's figures average about 1.2 compromised inboxes per affected organisation.

SpyCloud's recaptured account count is about 73% of Microsoft's compromised inbox figure.

About seven months passed between EvilTokens' February 2026 launch and the Sept. 15 seizure order.

Acting on a federal court order dated Sept. 15, Microsoft and partners seized 50 websites the phishing-as-a-service used for operations and disabled more than 175 domains linked to EvilTokens' supporting infrastructure.

The UK Metropolitan Police acted on Microsoft's information on Sept. 18, serving warrants in the greater London area, arresting the men accused of making articles for use in fraud and money laundering, and seizing their digital devices.

The Metropolitan Police Service received information about the suspects in August and executed warrants on Friday at addresses in Canary Wharf and Nine Elms.

The men, aged 32 and 38, have not been publicly identified and were released on bail as the investigation continues.

Microsoft said its legal filings, which have yet to be unsealed, refer to five additional unidentified people allegedly acting as support personnel and users.

The phishing-as-a-service operation emerged in February and was the first to support device code authentication at scale and to offer cybercriminals AI-powered features for customizing lures and sifting through compromised inboxes to identify high-value targets.