Microsoft Dismantles AI-Powered Phishing Network That Hit 12,000 Inboxes

 

Microsoft Dismantles AI-Powered Phishing Network That Hit 12,000 Inboxes

Microsoft has helped take down one of the more sophisticated cybercrime operations of the year — a subscription-based phishing service that used artificial intelligence to power nearly every stage of its attacks, from picking targets to writing convincing scam emails.

What Was EvilTokens?

The platform, which Microsoft's Digital Crimes Unit tracks internally as Storm-2992 and which operated publicly under the name EvilTokens, had been active since February 2026. It was sold openly on Telegram as a subscription service, priced at a $1,500 signup fee plus $500 a month, with additional add-on packages costing between $600 and $1,000.

What made EvilTokens dangerous wasn't just its pricing model — it was how it worked. The platform used an AI chatbot to scan through compromised mailboxes, automatically identify high-value targets, and draft personalized phishing and impersonation emails tailored to each victim. Rather than stealing passwords directly, the service exploited a legitimate Microsoft sign-in feature called the OAuth 2.0 device-authorization flow, a technique known as "device-code phishing" that let attackers obtain valid access tokens while bypassing multi-factor authentication entirely.

The Scale of the Damage

By the time it was shut down, EvilTokens had compromised more than 12,000 Microsoft 365 inboxes across over 10,000 organizations worldwide. Security firm SpyCloud, one of the partners in the takedown, separately recovered 8,708 unique victim accounts spread across 6,585 corporate domains in 79 countries. The organizations hit spanned wholesale distribution, construction, financial services, real estate, higher education, and healthcare — showing just how broadly the AI-powered service was being used.

How the Takedown Happened

Taking down EvilTokens required cooperation across the tech and security industry. Microsoft's Digital Crimes Unit obtained authorization from a federal court in the Eastern District of Virginia, allowing it to seize 50 websites and more than 150 domains tied to the operation. The effort brought together an unusually wide coalition, including Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, the Shadowserver Foundation, Health-ISAC, and blockchain analytics firm TRM Labs — each contributing a different piece, from network data to cryptocurrency payment tracing.

That crypto tracing paid off. Investigators followed roughly $1.1 million in revenue collected between October 2025 and June 2026, spread across more than 700 different addresses on the Tron blockchain. UK police had already arrested two suspected administrators of the operation in London on September 11, ahead of this week's formal infrastructure seizure.

Why This Case Matters

EvilTokens is a clear example of a trend security researchers have been warning about for the past year: AI is lowering the technical bar for large-scale cybercrime. Attacks that once required a skilled team can now be run largely on autopilot, with AI handling the research, targeting, and message-writing that used to take real time and expertise.

At the same time, this takedown shows the other side of that same coin. The coalition that dismantled EvilTokens used its own mix of automated detection, cross-company data sharing, and blockchain analysis to trace and dismantle the network far faster than traditional investigation alone could have managed. It's a reminder that in cybersecurity today, AI isn't just a threat — used well, it's also one of the strongest tools defenders have.

📺 Watch the full breakdown on YouTube — NEWS 2026 VIEWS 👉

Subscribe to NEWS 2026 VIEWS for daily technology and AI video coverage.