Microsoft-led takedown disrupts EvilTokens phishing service tied to 12,000 hacked inboxes

Microsoft's Digital Crimes Unit, acting under authority from the US District Court for the Eastern District of Virginia, seized 50 websites and disabled more than 150 domains tied to EvilTokens, a phishing-as-a-service platform blamed for compromising over 12,000 email inboxes at more than 10,000 organisations worldwide¹². The service, which Microsoft tracks as Storm-2992, specialised in device-code phishing: tricking victims into entering an attacker-generated code on Microsoft's genuine sign-in page, handing over authenticated access tokens without a password and able to survive a password reset if sessions were not separately revoked¹².

Microsoft worked with Cloudflare, Coinbase, OpenAI, Health-ISAC, SpyCloud and other partners on the action; separately, the UK's Metropolitan Police arrested two men, aged 32 and 38, on 11 September over their suspected role running the service¹². Identity threat firm SpyCloud independently found 8,708 compromised accounts across 6,585 corporate domains in 79 countries¹.

Why it matters: Device-code phishing sidesteps passwords and MFA entirely, and a service this organised, with AI-assisted lure crafting and dozens of phishing kits sold by subscription, shows how far phishing has industrialised, even as Microsoft cautions the threat remains active despite the takedown².