EvilTokens Takedown: Microsoft Seizes 50 Sites, 2 Arrested

For seven months, anyone with $1,500 and a Telegram account could rent a phishing kit that stole Microsoft 365 sessions without ever touching a password, then hand the stolen mailbox to an AI assistant that pointed out who approves wire transfers. That service is now down. Microsoft's Digital Crimes Unit (DCU) used a federal court order to seize the infrastructure behind EvilTokens, and British police arrested two suspected operators in London. The disruption is real. The threat is not over, and the defenses that matter did not change on Tuesday.

Key Takeaways

• Microsoft and its partners seized 50 websites used to run EvilTokens and disabled more than 150 additional domains, under an order from the U.S. District Court for the Eastern District of Virginia, Microsoft announced on September 22, 2026.
• The Metropolitan Police Service arrested two men, aged 32 and 38, on September 11, 2026, on suspicion of making articles for use in fraud and money laundering; both were released on bail while the investigation continues.
• EvilTokens, which Microsoft tracks as the work of Storm-2992, was linked to more than 12,000 compromised inboxes at over 10,000 organizations since launching in February 2026.
• Coinbase traced roughly $1.1 million in platform revenue across four Tron addresses, while the service used AI to read stolen mailboxes and draft business email compromise (BEC) messages.
• Microsoft's own guidance says stolen access can survive a password reset, so Microsoft 365 administrators should block device code flow with Conditional Access and revoke sessions on any affected account.

What Was EvilTokens?

EvilTokens was a phishing as a service platform, sold on Telegram, that abused Microsoft's OAuth 2.0 device authorization flow to hijack Microsoft 365 accounts. A victim received a lure (an invoice, an RFP, a shared file, a voicemail notice) that led to a page showing a live device code and a "Continue with Microsoft" button. The victim pasted the code into the real microsoft.com/devicelogin page, completed their own sign in and MFA, and unknowingly authorized the attacker's session. We covered the mechanics in depth when EvilTokens first surfaced in April and again when its OAuth token abuse spread across Microsoft 365 tenants.

The pricing, per Microsoft Threat Intelligence, was $1,500 up front plus $500 a month for the kit and control panel, with add ons such as an Antibot redirector, a B2B Sender, and an SMTP Sender billed separately. Subscribers picked from 44 lure themes and could route traffic through Vercel, Cloudflare Workers, and AWS Lambda to slip past domain blocklists.

How Did Microsoft Take Down EvilTokens?

Microsoft took down EvilTokens through a civil lawsuit, not a hack back: a court order from the U.S. District Court for the Eastern District of Virginia let it seize the service's domains. Health-ISAC, the nonprofit that shares threat intelligence among healthcare organizations, joined as co plaintiff because healthcare organizations were among the targets. According to Microsoft's announcement by DCU general manager Steven Masada, the operation seized 50 websites used to operate the service and disabled more than 150 additional domains tied to its supporting infrastructure.

No single company could have done it alone. The Hacker News lists Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs among the partners, alongside Cloudflare. Microsoft told The Record that EvilTokens "drew on capabilities from multiple AI models" and called OpenAI "an important partner" in the effort, while declining to name the other AI platforms involved.

The court filings Microsoft published name two defendants, Felix Utomi and Waidi Segun Adams, plus five unnamed Does. Microsoft obtained a temporary restraining order and is seeking a preliminary injunction that transfers the domains to its control. The complaint is a civil action; nothing Microsoft has published links those names to the men arrested in London. This is the DCU's 40th court authorized disruption and, by Microsoft's count, its first against a cybercrime service that used AI from initial access through to the fraud itself.

Who Was Arrested in the EvilTokens Case?

Two men, aged 32 and 38, were arrested in the United Kingdom on September 11, 2026, and Microsoft describes them as alleged operators of EvilTokens. Officers from the Metropolitan Police Service's cybercrime team executed warrants at two locations and seized digital devices. The Met told The Record the arrests were on suspicion of making articles for use in fraud and money laundering offenses. Both men have been released on police bail with conditions.

Microsoft first reported EvilTokens to the Met in August, which means roughly a month passed between the referral and the raids, and another eleven days before the infrastructure seizure went public. Microsoft has not identified either man, and a spokesperson said "others may have supported the service in various capacities." Arrest is not charge; nobody has been convicted of anything.

How Did EvilTokens Use AI to Run BEC Fraud?

EvilTokens used AI to do the slow, skilled part of business email compromise: reading a stolen mailbox and working out who to impersonate and which payment to redirect. Masada wrote that its tools could "summarize and translate emails, surface financial conversations, map organizational roles, identify trusted relationships, and recommend potential targets." Preset prompts searched for wire transfer discussions, located vendor invoices, and identified an organization's "money movers."

Microsoft summed it up bluntly: "In short, AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible." SpyCloud's Trevor Hilligoss said the kit was "reading compromised mailboxes in more than twenty languages to find the conversations worth hijacking, and drafting the impersonation mail that follows." Investigators also found that large portions of EvilTokens itself had been "vibe coded," built with AI assistance by its own operators.

Microsoft also documented Microsoft Graph reconnaissance to map org charts and permissions, malicious inbox rules to hide replies from the real mailbox owner, and, in some intrusions, registration of a new device within 10 minutes to mint a Primary Refresh Token for persistence.

How Big Was the EvilTokens Operation?

Microsoft links EvilTokens to more than 12,000 compromised inboxes across over 10,000 organizations, concentrated in the United States, Canada, the United Kingdom, Australia, India, and France. Independent data points line up with that scale:

• SpyCloud's recaptured phishing data, reported by BleepingComputer, shows 8,708 victim accounts across 6,585 corporate email domains in 79 countries, with the earliest captures dated February 18, 2026.
• Roughly 97.5% of those compromised accounts belonged to enterprise domains, which fits a tool built for invoice and payment fraud rather than consumer scams.
• Coinbase traced approximately $1.1 million in platform revenue across four Tron addresses between October 2025 and June 2026, from more than 1,000 deposits sent by over 700 distinct addresses.

The growth curve is the striking part. When we first wrote about EvilTokens in April, researchers had counted more than 340 affected organizations. Five months later Microsoft counts over 10,000, a roughly 29 fold increase. And the $1.1 million figure only measures what the operators earned from subscriptions. It says nothing about what their customers stole through redirected invoices, which is where BEC losses actually land.

Is EvilTokens Really Gone?

No. Most headlines call this a takedown, but BleepingComputer's reporting is explicit that the seizure was a disruption: the threat remains active, though attack volume should drop noticeably. Affiliates have already produced clones such as APToken.

Seizing domains also does nothing to tokens already stolen. Microsoft warns that EvilTokens access "could persist even after a password reset if the associated sessions and tokens were not also revoked." Any tenant compromised before September 22 may still have an attacker holding a valid refresh token, a registered device, or a forwarding rule. The technique itself is also bigger than one brand: this site has already tracked DEBULL, the third device code kit aimed at Microsoft 365, and a separate MFA bypass kit, Kratos, was dismantled only in July.

Why Email Users Should Care

EvilTokens turned the inbox into the attacker's reconnaissance database. Every thread about a supplier payment, every signature block naming a CFO, every "please update our bank details" reply became input for an AI that ranked who to impersonate next. Microsoft's conclusion is the part worth repeating to any finance team: assume that once an inbox is compromised, criminals may understand its contents in minutes, not days.

That matters well beyond the 12,000 breached mailboxes. When an attacker sends a payment change request from a real colleague's account, quoting a real thread, the usual advice to check the sender address fails completely. BEC was already among the costliest categories of online fraud, as the FBI's latest IC3 figures show; automating the reading step removes the last bottleneck. The only reliable control is procedural: verify any request to change payment details through a second channel you already trust, such as a known phone number, never a number in the email.

What Should Microsoft 365 Admins Do Now?

Microsoft 365 admins should block device code flow, hunt for past device code sign ins, and fully revoke access on any account that shows one. Microsoft's Conditional Access guidance on authentication flows recommends getting "as close as possible to a unilateral block on device code flow." Concretely:

• Block device code flow. Create a Conditional Access policy using the Authentication flows condition, scoped to all users and all resources, excluding break glass accounts. Run it in report only mode first to see who still depends on the flow.
• Scope exceptions tightly. If Teams devices need device code flow, Microsoft advises limiting the exception to those specific Teams device resource accounts and excluding the Device Registration Service resource from the policy.
• Hunt in sign in logs. In the Entra portal, filter Sign in logs by Authentication Protocol set to Device code. In Sentinel or Log Analytics, query SigninLogs | where AuthenticationProtocol == "deviceCode" and review every hit since February against known device inventory.
• Revoke, then disable. Call revokeSignInSessions on affected users, but Microsoft notes this can leave access tokens valid for up to an hour, so it recommends temporarily disabling the account for immediate containment. Disable any attacker registered device so its Primary Refresh Token stops working.
• Audit mailboxes. Check affected accounts for new inbox rules, forwarding, and recently registered devices, and alert on suspicious inbox rule creation going forward.
• Move to phishing resistant MFA. Passkeys and FIDO2 keys, backed by a sign in risk policy, shrink the window for any token based attack.
• Brief users in one sentence. Never paste a code from an email or web page into microsoft.com/devicelogin unless you are personally signing in to a TV, printer, or conference room device right now.

For compliance teams, note that Microsoft says it notified affected customers. If your organization received such a notice, treat it as a confirmed mailbox compromise with possible exposure of personal data in email content, which may trigger breach assessment duties under GDPR or state breach notification laws. Kits like VoidProxy show the next service is already running; the controls above apply to all of them.