Full Report
Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) "at every step of the attack chain." The action, carried out with authorization from the U.S. District Court for the Eastern District of Virginia, involved the efforts of Health-ISAC, alongside Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver
Analysis Summary
# Incident Report: Takedown of EvilTokens Phishing-as-a-Service
## Executive Summary
Microsoft and a global coalition of partners disrupted "EvilTokens," a sophisticated Phishing-as-a-Service (PhaaS) platform that utilized artificial intelligence to automate Business Email Compromise (BEC). The service abused OAuth 2.0 device code flows to bypass credentials and MFA, resulting in at least 12,000 inbox compromises. The operation led to the seizure of infrastructure and the arrest of two primary operators in the UK.
## Incident Details
- **Discovery Date:** March 2026 (Initially documented by Huntress)
- **Incident Date:** Active from mid-February 2026 until takedown on September 22, 2026
- **Affected Organization:** Approximately 12,000 individual inboxes across various entities
- **Sector:** Cross-sector (Financial, Healthcare, and Corporate)
- **Geography:** Global; Court action centered in Eastern District of Virginia (US); Arrests in United Kingdom
## Timeline of Events
### Initial Access
- **Date/Time:** February 2024 (Service launch)
- **Vector:** Phishing via Device Code Authentication abuse.
- **Details:** Attackers sent lures containing a unique device code. Victims were tricked into entering this code at a legitimate Microsoft verification URL (microsoft[.]com/devicelogin), granting the attacker an OAuth token.
### Lateral Movement
- **Details:** Attackers used stolen session tokens to maintain persistence. In some instances, tokens were used to register new unauthorized devices to the victim's account to ensure redundant access.
### Data Exfiltration/Impact
- **Details:** AI-driven chatbots automatically scanned compromised inboxes to identify "money movers," pending invoices, and sensitive relationships. Attackers exfiltrated emails and engaged in wire-transfer fraud.
### Detection & Response
- **March 2026:** Security researchers (Huntress/Sekoia) identified the PhaaS platform and Telegram sales channels.
- **September 11, 2026:** Metropolitan Police Service arrested two men (ages 32 and 38) related to the operation.
- **September 22, 2026:** Microsoft announced a coordinated legal and technical takedown involving Cloudflare, OpenAI, and law enforcement.
## Attack Methodology
- **Initial Access:** Abuse of OAuth 2.0 Device Authorization Flow (no password required).
- **Persistence:** Malicious inbox rules to hide communications and registration of new devices via stolen tokens.
- **Defense Evasion:** Use of legitimate verification URLs (microsoft[.]com) to bypass traditional URL filters.
- **Credential Access:** Token theft (EvilTokens/Session Hijacking).
- **Discovery:** AI-powered analysis of inboxes to map organizational roles and identify financial threads.
- **Impact:** Financial fraud, BEC, and large-scale data exfiltration.
## Impact Assessment
- **Financial:** Significant potential losses via automated wire-transfer fraud (specific figures not disclosed).
- **Data Breach:** Compromise of 12,000+ individual email accounts.
- **Operational:** Disruption of business communications via malicious inbox rules.
- **Reputational:** High impact for affected organizations due to impersonation of "trusted contacts."
## Indicators of Compromise
- **Network Indicators:**
- microsoft[.]com/devicelogin (Legitimate site, but used in context of unexpected code requests)
- hxxps://t[.]me/+wNBoU1Gl2mRiYmU0 (Telegram Group)
- **Behavioral Indicators:**
- Unexpected OAuth token requests for "Device Code" flows.
- Creation of new inbox rules to move messages to "Deleted Items" or "Archive" automatically.
- New device registrations from unfamiliar IP ranges.
## Response Actions
- **Containment:** U.S. District Court authorized the seizure of malicious domains and infrastructure.
- **Eradication:** Law enforcement arrests of key developers/operators (Storm-2992).
- **Recovery:** Revocation of compromised OAuth tokens by Microsoft.
## Lessons Learned
- **AI as a Force Multiplier:** Attackers are now using LLMs to perform reconnaissance *inside* a mailbox, drastically reducing the time between initial access and fraud.
- **MFA Bypass:** Traditional MFA is insufficient against Device Code phishing; organizations must scrutinize OAuth flow permissions.
- **Cooperation is Key:** Successful disruption required private tech firms (OpenAI, Cloudflare) and public law enforcement working in tandem.
## Recommendations
- **Restrict Device Code Flow:** Disable the Device Code Flow in Microsoft Entra ID if it is not required for business operations.
- **Conditional Access:** Implement strict Conditional Access policies that require managed/compliant devices for sensitive roles.
- **Monitor Inbox Rules:** Audit for "hidden" inbox rules that forward or delete mail automatically.
- **User Education:** Train employees to never enter codes into a login screen they did not personally initiate on their own device.