WASHINGTON — In a landmark coordinated strike against modern cybercrime infrastructure, Microsoft’s Digital Crimes Unit (DCU), acting in tandem with global law enforcement agencies and prominent cybersecurity organizations, has successfully neutralized EvilTokens. This highly sophisticated phishing-as-a-service (PaaS) platform leveraged cutting-edge artificial intelligence to execute business email compromise (BEC) attacks at scale.
The operation marks Microsoft’s 40th successful court-authorized disruption, highlighting an escalating global war against automated, AI-assisted cybercrime rings. However, it also exposes a chilling evolution in threat actor methodology: the weaponization of generative AI not just to write malicious code, but to autonomously navigate victim corporate networks, analyze sensitive financial workflows, and orchestrate precision fraud.
Main Facts
EvilTokens established itself as a premier turnkey cybercrime platform following its emergence in early 2026. Designed to lower the technical barrier to entry for aspiring threat actors, the platform operated on a subscription or revenue-share model, providing cybercriminals with all the tools necessary to bypass modern multi-factor authentication (MFA) protocols.
According to telemetry data released by Microsoft and Health-ISAC, EvilTokens has been linked to the successful compromise of more than 12,000 corporate inboxes across upwards of 10,000 distinct organizations since February 2026. While official financial losses currently stand at approximately $1.7 million spread across 13 distinct FBI complaints, cybersecurity experts emphasize that this figure is exceptionally conservative. Because many organizations choose not to report breaches publicly—or remain entirely unaware that their systems have been silently infiltrated—the true economic damage caused by EvilTokens is suspected to be significantly higher.
The disruption effort was executed under a sweeping order issued by the U.S. District Court for the Eastern District of Virginia. Utilizing this legal authority, Microsoft seized 50 foundational websites and disabled more than 150 malicious domains associated with the EvilTokens infrastructure.
The takedown was far from a solo endeavor. Microsoft orchestrated a broad coalition of public and private sector partners, including:
- Health-ISAC (Health Information Sharing and Analysis Center)
- Cloudflare
- Coinbase
- OpenAI
- SpyCloud
- TRM Labs
- The Shadowserver Foundation
Concurrently, international physical law enforcement moved in. The Metropolitan Police in London arrested two primary suspects earlier in the month. Identified in reports by CyberScoop as 32-year-old Felix Utomi and 38-year-old Waidi Segun Adams, both men have since been released on bail as investigations continue. Microsoft internally tracks the primary threat actor group responsible for operating the platform under the designation Storm-2992.
Chronology of the Operation
The dismantling of EvilTokens represents the culmination of months of intensive digital forensics, cross-border intelligence sharing, and meticulous legal positioning.
- February 2026: EvilTokens dramatically scales its operations, rapidly accumulating thousands of corporate victims by deploying an automated phishing-as-a-service framework designed specifically to target cloud-based enterprise environments.
- Spring to Summer 2026: As telemetry data aggregates within Microsoft’s Threat Intelligence Center, analysts identify a novel operational pattern. Unlike traditional phishing kits that merely harvest credentials, EvilTokens integrates an onboard AI chatbot capable of autonomously parsing stolen email archives. Microsoft designates the operational group behind the infrastructure as Storm-2992.
- Early September 2026: Metropolitan Police officers in the United Kingdom execute coordinated raids, arresting Felix Utomi (32) and Waidi Segun Adams (38) in connection with the operation of the EvilTokens platform. Both suspects are taken into custody for questioning before being released on bail.
- Mid-September 2026: Microsoft builds a comprehensive legal case, petitioning the U.S. District Court for the Eastern District of Virginia for emergency injunctive relief to sever the threat group’s command-and-control capabilities.
- September 22, 2026: Microsoft’s Digital Crimes Unit officially executes the court order. Working alongside an alliance of tech giants and cybersecurity foundations, the DCU seizes 50 websites, neutralizes more than 150 domains, and cuts off access to the EvilTokens infrastructure. Simultaneously, Microsoft publishes extensive technical and threat-intelligence briefings detailing the anatomy of the attacks.
Supporting Data and Technical Architecture
The technical sophistication of EvilTokens sets it apart from the commoditized phishing kits that have dominated the cybercrime underground for the past decade. The platform relied primarily on device-code phishing, a clever social engineering technique designed to exploit legitimate cloud authentication workflows.
The Attack Chain: Anatomy of a Device-Code Phish
- The Lure: Victims receive convincing phishing lures—often disguised as routine administrative notices from Microsoft or document-signing prompts from DocuSign—directing them to a lookalike authentication portal.
- The Code Presentation: The fake portal displays a unique user-verification device code.
- The User Action: Tricked into believing they are authorizing a routine software login or identity verification, the victim copies the code and pastes it into Microsoft’s genuine sign-in page. Because the user is interacting with the legitimate Microsoft portal, they successfully complete their own Multi-Factor Authentication (MFA) challenge.
- The Token Hijacking: By completing this process, the victim inadvertently authorizes the attacker’s remote session. The malicious infrastructure captures a working, high-privilege authentication token. Crucially, these tokens often survive standard password resets, granting persistent, silent access to the threat actor even if the user subsequently changes their account password.
"Vibe Coding" and AI-Driven Exploitation
What truly distinguished EvilTokens, however, was what happened after initial access was achieved. Once inside an organization’s cloud environment, EvilTokens deployed an integrated artificial intelligence chatbot.
According to Microsoft engineers, large portions of this post-exploitation capability were built using "vibe coding"—a modern software development methodology where creators use conversational AI models to rapidly generate functional code without needing deep, manual programming expertise. In a chilling case of technological irony, the cybercriminals successfully utilized AI to construct a tool that, in turn, utilized AI to exploit human beings.
This onboard chatbot possessed the capability to:
- Autonomously read and index the victim’s entire mailbox history.
- Map internal corporate hierarchies, specifically identifying payment approvers, finance executives, and invoice processing workflows.
- Intelligently suggest which trusted internal or external contacts the attacker should impersonate to maximize the credibility of subsequent Business Email Compromise (BEC) fraud.
Official Responses
The takedown of EvilTokens has prompted significant commentary from leadership across the technology and cybersecurity sectors, emphasizing both the success of public-private collaboration and the sobering reality of AI-augmented threats.
In a joint technical and corporate statement, Microsoft’s Digital Crimes Unit emphasized the necessity of cross-industry coalitions in combating modern cybercrime syndicates.
"Threat actors like Storm-2992 are no longer relying solely on manual reconnaissance or basic credential harvesting," a Microsoft spokesperson told CyberScoop. "By embedding generative AI directly into phishing-as-a-service frameworks, they have industrialized the art of corporate espionage and financial fraud. Disrupting EvilTokens required a synchronized global response that matches the speed and scale of today’s modern cybercriminal enterprises."
Health-ISAC, which partnered closely with Microsoft to protect healthcare and public health sector organizations from EvilTokens infiltration, highlighted the disproportionate risk facing critical infrastructure providers. Healthcare organizations hold vast amounts of sensitive financial and personal data, making them prime targets for sophisticated BEC campaigns designed to divert wire transfers or compromise supply chain payment mechanisms.
OpenAI, which contributed intelligence and platform integrity support to the operation, underscored the ongoing cat-and-mouse game surrounding the misuse of generative AI technologies.
"We are firmly committed to preventing malicious actors from weaponizing artificial intelligence," an OpenAI representative noted following the disruption. "Our collaboration with Microsoft and other industry defenders demonstrates that when the tech community shares actionable threat intelligence, we can effectively neutralize platforms attempting to scale abuse via AI."
Broader Implications and Industry Context
The dismantling of EvilTokens does not occur in a vacuum. It represents the latest victory in an aggressive, sustained campaign by Microsoft to dismantle the infrastructure underpinning modern email fraud. Over the past twelve months, Microsoft’s DCU has systematically targeted a series of high-profile phishing and credential-theft operations, including RaccoonO365, RedVDS, Tycoon 2FA, and Fox Tempest.
However, the emergence of EvilTokens signals a fundamental shift in how organizations must view email security, identity governance, and trust.
The Failure of Traditional Domain Authentication
For cybersecurity professionals, EvilTokens highlights an uncomfortable truth: traditional email authentication standards—while vital—are no longer sufficient to stop advanced BEC attacks.
Technologies such as DKIM (DomainKeys Identified Mail), SPF (Sender Policy Framework), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) are designed to verify that an email originated from an authorized mail server and that its contents have not been tampered with in transit.
However, when a threat actor successfully hijacks a legitimate corporate mailbox via device-code phishing:
- The fraudulent invoice or wire-transfer request is sent directly from the real, compromised corporate email account.
- The message is signed using the organization’s genuine DKIM key.
- The message exits from legitimate, trusted corporate mail servers.
- Consequently, DMARC passes with flying colors.
Domain authentication proves ownership of the domain infrastructure; it says nothing about whether the human or automated system holding the session keys at that exact moment is authorized to do so. Trusting an email simply because it passes cryptographic domain checks is a fatal vulnerability in the modern threat landscape.
Reinventing Enterprise Defenses
To counter platforms like EvilTokens and their inevitable successors, security architects must pivot their defense strategies toward identity-centric controls and strict procedural verification:
- Identity and Access Management (IAM): Organizations that have no legitimate business requirement for device-code sign-in workflows should immediately block them using robust Conditional Access policies.
- Behavioral Token Monitoring: Security operations centers (SOCs) must begin treating unusual authentication token generation, anomalous session persistence, and atypical API access with the same rigorous scrutiny traditionally reserved for failed login attempts or malware execution alerts.
- Out-of-Band Financial Verification: At the receiving and operational ends of the business, technical controls must be supplemented by unyielding human protocols. Any unexpected modification to bank account details, vendor payment destinations, or routing instructions received via email—even if coming from a trusted, verified internal executive mailbox—must be independently confirmed via a pre-established, trusted phone number known to the organization prior to the communication.
As artificial intelligence continues to lower the barrier to entry for sophisticated cybercrime, the takedown of EvilTokens serves as both a blueprint for international law enforcement cooperation and a stark warning to enterprise defenders: the perimeter is no longer a network wall; it is the identity of every user, and the stakes of compromise have never been higher.
