Microsoft’s Digital Crimes Unit has disrupted EvilTokens, a phishing-as-a-service platform linked to more than 12,000 compromised inboxes at over 10,000 organisations since February. Working with Health-ISAC under an order from the US District Court for the Eastern District of Virginia, Microsoft seized 50 websites and disabled more than 150 domains. Partners included Cloudflare, Coinbase, OpenAI, SpyCloud, TRM Labs and the Shadowserver Foundation.
The Metropolitan Police arrested two men, aged 32 and 38, earlier this month. Microsoft named them to CyberScoop as Felix Utomi and Waidi Segun Adams. Both are on bail. Microsoft tracks the operator as Storm-2992 and says this is the unit’s 40th court-authorised disruption.
The way in was device-code phishing. Lures led to fake Microsoft or DocuSign pages showing a code. The victim typed it into Microsoft’s genuine sign-in page and completed their own MFA. The attacker received a working token that survives a password reset. Microsoft’s security team has published a technical analysis.
The new part came after access. EvilTokens included a chatbot that read the victim’s mailbox, mapped payment approvers and invoice workflows, and suggested which trusted contact to impersonate. Microsoft says large parts of the platform were “vibe coded”. The criminals used AI to build a tool that used AI to read other people’s email.
A Microsoft spokesperson told CyberScoop the company had matched 13 FBI complaints to EvilTokens, with about $1.7m in reported losses, and called that a conservative estimate.
For anyone who works on authentication, the lesson is uncomfortable. A fake invoice sent from a hijacked real mailbox is signed with the real DKIM key, leaves from the real servers and passes DMARC. Domain authentication proves the domain. It says nothing about who is holding the account.
The defences sit on the identity side. Organisations with no need for device-code sign-in can block it with Conditional Access, and unusual token activity deserves the same attention as failed logins. On the receiving end, a change of bank details by email still needs a phone call to a number you already had.
EvilTokens follows RaccoonO365, RedVDS, Tycoon 2FA and Fox Tempest in Microsoft’s run of email-fraud takedowns over the past year. Microsoft summarises them here.
