Microsoft Disrupts EvilTokens Device Code Phishing Service

Microsoft announced on Tuesday that it disrupted EvilTokens, an AI-powered phishing-as-a-service platform used to break into more than 12,000 email inboxes at over 10,000 organizations.

The service emerged in February 2026. Microsoft Threat Intelligence tracks its developer as Storm-2992 and found victims concentrated in the US, Canada, the UK, Australia, India, and France.

EvilTokens abused device code authentication, a sign-in method built for TVs, printers, and other devices without a keyboard. The attacker starts the sign-in and sends the resulting code to the victim in a phishing lure. The victim enters it on the genuine microsoft.com/devicelogin page, and the attacker’s session gets into the account without a password changing hands, which also gets it past multifactor authentication.

AI ran through the whole attack chain. It tailored lures across 44 themes to each target’s role. It then combed compromised inboxes for finance and executive staff, wire transfer details, and pending invoices. Steven Masada, general manager of Microsoft’s Digital Crimes Unit (DCU), warned that once an inbox falls, “criminals may understand its contents in minutes, not days.”

Storm-2992 sold access on Telegram for $1,500, plus $500 a month.

Acting under authorization from the US District Court for the Eastern District of Virginia, Microsoft seized 50 websites used to run the service and disabled more than 150 other domains associated with it. Health-ISAC joined Microsoft in the legal action. The operation is the DCU’s 40th court-authorized disruption and its first against an end-to-end AI-enabled cybercrime service.

Metropolitan Police cybercrime officers in the UK arrested two men, aged 32 and 38, on September 11 and seized digital devices. Both have been released on police bail while the investigation continues. Microsoft’s complaint names Felix Utomi and Waidi Segun Adams, along with five unnamed individuals.

Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs supported the operation. SpyCloud contributed recaptured phishing data covering 8,708 victim accounts across 6,585 corporate email domains in 79 countries.

Microsoft recommends blocking device code flow wherever possible. For a compromised account, it advises temporarily disabling the account, because revoking sessions can leave access tokens valid for up to an hour.