Microsoft Disrupts EvilTokens Device Code Phishing Service

Microsoft and partners disrupted EvilTokens, an AI-powered phishing-as-a-service platform (attributed to operators called "Storm-2992") that automated device-code phishing to enable large-scale business email compromise; the takedown included seizure of infrastructure, domain disables, partner investigations that identified thousands of compromised accounts, and arrests while advising defenders to restrict device code flow where possible.