Overview
- Microsoft led a court‑ordered operation that seized 50 EvilTokens websites and disabled more than 175 supporting domains as part of a disruption announced on Tuesday, September 22, 2026.
- Investigators linked the service to more than 12,000 compromised Microsoft 365 inboxes across over 10,000 organizations and said about 1,000 cybercriminals used the platform.
- EvilTokens used AI to analyze victims’ inboxes and guided subscribers through business‑email compromise campaigns that abused Microsoft’s device authorization (device‑code) OAuth flow to obtain persistent session tokens that bypassed multi‑factor authentication.
- Coinbase traced roughly $1.1 million in revenue to the service and Microsoft correlated at least 13 FBI IC3 complaints representing about $1.7 million in reported losses, though officials say total fraud is likely higher due to underreporting.
- UK police arrested two men identified by Microsoft as alleged operators and later released them on bail, and industry partners urged defenders to treat unsolicited device codes as a red flag and to use conditional access and other controls to limit device‑code abuse.