Overview
- Microsoft led a court-authorized operation that seized 50 websites and disabled more than 150 domains used by EvilTokens, and the company publicly announced the disruption on Tuesday, Sept. 22.
- Investigators tied EvilTokens to compromises of more than 12,000 Microsoft inboxes across over 10,000 organizations and said the platform gave attackers persistent access by abusing the OAuth device-authorization (device-code) flow.
- The service combined AI tools that analyzed compromised mailboxes and drafted targeted fraud messages with a subscription model sold on Telegram, and Coinbase traced roughly $1.1 million in platform revenue.
- UK police arrested two men linked to the platform and later released them on bail while devices and evidence were seized and the inquiry continues.
- Responders warned that disabling or tightly restricting device-code flows, revoking sessions and refresh tokens for suspected compromises, and adopting phishing‑resistant authentication are key because PhaaS clones and device-code phishing are likely to continue.