Artificial Intelligence · Cybersecurity
Microsoft disrupts EvilTokens phishing service
Microsoft said it disrupted EvilTokens, a device-code phishing service linked to more than 12,000 inbox compromises, with court authorisation and help from law enforcement and private-sector partners.
- Microsoft announced the takedown of EvilTokens on Tuesday and said a federal court in Virginia had authorised the action.
- It said the operation involved Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs, and that police arrested two men aged 32 and 38 on 11 September 2026.
- Microsoft said it had linked EvilTokens to more than 12,000 email inbox compromises across over 10,000 organisations worldwide.
- Coinbase said it traced about $1.1 million in revenue across four Tron addresses between October 2025 and June 2026, and SpyCloud said it shared data on 8,708 compromised victim accounts.
Microsoft said it had disrupted EvilTokens and that a federal court in Virginia had authorised the action. The company said the operation involved several private-sector partners, and the Metropolitan Police Service arrested two men aged 32 and 38 on 11 September 2026 in connection with the case. Microsoft said it had also seized 50 websites and disabled more than 150 related domains.
Microsoft said it tracked the people behind EvilTokens as Storm-2992. Huntress had first documented the service in March 2026, and Sekoia later described it as a phishing service sold through Telegram with templates and AI features.
Microsoft and TRM Labs said the service combined account compromise, inbox analysis and fraud preparation. Microsoft said it had tied EvilTokens to more than 12,000 inbox compromises across over 10,000 organisations, while Coinbase said it traced about $1.1 million in revenue and SpyCloud said it shared data on 8,708 compromised victim accounts.
Named in this story
Companies
- Microsoft
- announced the takedown and described the service
- Cloudflare
- took part in the disruption effort
- Coinbase
- took part in the disruption effort and traced revenue
- OpenAI
- took part in the disruption effort
- Railway
- took part in the disruption effort
- SpyCloud
- shared recovered victim data
- TRM Labs
- took part in the disruption effort
- Huntress
- first documented EvilTokens in March 2026
- Sekoia
- published reports describing EvilTokens as a sold phishing service
Organisations
- Health-ISAC
- took part in the disruption effort
- The Shadowserver Foundation
- took part in the disruption effort
- Storm-2992
- Microsoft’s label for the threat actors behind EvilTokens
Governments and agencies
- U.S. District Court for the Eastern District of Virginia
- authorised the takedown action
- Metropolitan Police Service
- arrested two men in connection with the operation
Products and systems
- EvilTokens
- the phishing service that was disrupted
- Telegram
- was used to market and run the service
How the source tells it
The article read like a security press release, with alarm and vendor-style boosterism carried mostly through the companies’ own claims.
- alarm Large victim counts and disruption language framed the service as a broad threat
- hype Company and partner statements about AI-driven fraud tooling gave the piece a sales-pitch tone