Microsoft and partners disrupted EvilTokens, a cybercrime platform. It used AI at every step of the attack chain. The platform stole tokens for account takeover and business email compromise. A court order on Sept. 15 enabled the seizure of 50 websites and 175 domains. EvilTokens launched in February 2026 and compromised over 12,000 Microsoft email inboxes. About 1,000 cybercriminals used the service. It targeted victims in the US, Canada, UK, Australia, India and France. Microsoft identified two operators, Felix Utomi and Waidi Segun Adams. The UK Metropolitan Police arrested them on Sept. 18. EvilTokens sold access via Telegram for a $1,500 fee and $500 monthly subscription. It bypassed multi-factor authentication and email security tools. Microsoft linked at least $1.7 million in losses to its activity. Coinbase traced $1.1 million in revenue for EvilTokens.

• 12,000 compromised Microsoft customer email inboxes
• 10,000 organizations globally affected
• 1,000 cybercriminals used EvilTokens
• $1.7 million in reported losses