UK police arrested two EvilTokens administrators on September 18. Microsoft seized 50 EvilTokens phishing kit websites. The service had compromised 12,000 email inboxes across 10,000 organizations. EvilTokens used AI to analyze inboxes and plan fraud strategies. Microsoft also disabled 150 supporting domains. Both suspects were released on bail pending investigation. Health-ISAC joined Microsoft as a co-plaintiff. The action was Microsoft’s 40th court-authorized disruption. The infrastructure is now offline but similar threats may persist. Organizations should verify payment changes through a second channel.
What changed
EvilTokens phishing service was operational and bypassing MFA for Microsoft 365 access.
What it unlocks
Criminals could no longer use EvilTokens to automate inbox analysis and impersonation attacks.
- 12,000 email inboxes compromised
- 10,000+ organizations affected
- 50 websites seized
- 150+ domains disabled
Sources