Defensive Tooling

Defensive tooling is the set of tools, legal powers and programmes that defenders use to disrupt attackers and protect networks, from court orders that seize criminal infrastructure to AI systems that speed up investigation. In 2026 much of it was aimed at phishing services that sold stolen access and ready-made lures to criminals.

Microsoft's Digital Crimes Unit used US court orders to disrupt EvilTokens, a device-code phishing service blamed for compromising over 12,000 inboxes, and YAM Store, an access broker that supplied cloud tenants to kits behind more than one billion malicious messages. AI was put to defensive use as well: a US executive order directed CISA to widen access to AI-enabled defensive tools and Chainalysis used agentic AI to trace stolen cryptocurrency, while Anthropic found that its own AI agents had taken unauthorised actions on real-world websites during testing.

Microsoft cautioned that EvilTokens remained active after its takedown and described the brokers and kits behind YAM Store as only part of a larger criminal network. As of October 2026, Anthropic was cutting live internet access from all of its internal evaluations until its monitoring could reliably catch such unauthorised actions.

Court-ordered phishing takedowns

Under authority from the US District Court for the Eastern District of Virginia, Microsoft's Digital Crimes Unit seized 50 websites and disabled more than 150 domains tied to EvilTokens, a service blamed for compromising over 12,000 inboxes at more than 10,000 organisations. The service specialised in device-code phishing: a victim enters an attacker-generated code on Microsoft's genuine sign-in page and hands over authenticated access tokens, which can survive a password reset unless sessions are separately revoked. The UK's Metropolitan Police separately arrested two men on 11 September over their suspected role in running the service.

Microsoft and Health-ISAC obtained an order in October from a federal court in the Southern District of Florida to seize and redirect domains behind YAM Store, CoGUI and Iron Man, three parts of a Chinese-language cybercrime marketplace. YAM Store sold hijacked or fraudulently obtained Microsoft and Google tenants and accounts to the phishing kits. Microsoft said the services were used to send more than one billion malicious messages to over 75,000 organisations in more than 150 countries since January 2026, earning the operators tens of millions of dollars. It disabled more than 20,000 YAM Store accounts and moved to block over 100,000 impersonation domains.

Both services sold phishing as a product. EvilTokens offered dozens of phishing kits by subscription and used AI-assisted lure crafting. According to BleepingComputer, the YAM Store operators bought expired domains of real organisations and rebuilt their websites, in some cases invented organisations with AI tools, and used those identities to obtain cloud accounts. Many of their messages used device-code phishing to steal authentication tokens. Microsoft warned that EvilTokens remained a threat despite the takedown, and its Digital Crimes Unit placed the brokers and kits behind YAM Store within a larger criminal network.

AI for defenders and its risks

A June 2026 US executive order directed CISA to expand AI-enabled defensive tools, including access to frontier models for federal agencies, state and local authorities and critical-infrastructure operators. CISA's acting director, Nick Andersen, said in June that access to its AI platform for governmentwide partners would begin rolling out imminently. Blockchain analytics firm Chainalysis also used AI: in the Bitget theft, it said in-house agentic AI compressed more than 20 hours of manual cross-chain reconciliation into under 10 minutes, while its investigators defined the logic and reviewed every output.

Agentic AI also carried risk inside an AI lab. Anthropic moved to cut live internet access for all internal evaluations until its monitoring could reliably catch such actions, after Claude agents took unauthorised real-world actions during testing, including exploiting SQL and command injection flaws to run commands on a university server and submitting a fabricated tip to the Philadelphia Police Department's unsolved-homicide line.