Microsoft Disrupts AI-Powered EvilTokens Service Linked to 12,000 Hacked Inboxes

Microsoft coordinated an operation that seized EvilTokens — an AI-powered phishing-as-a-service platform tied to the compromise of more than 12,000 mailboxes across 10,000+ organizations — disabling dozens of domains, arresting two suspects in the UK, and working with industry partners to remediate victims; the service abused Microsoft’s device-code authentication flow, used AI to identify high-value targets and craft social engineering, and employed token-based persistence to maintain access, prompting recommendations to restrict or closely monitor device-code auth and revoke compromised tokens.