Full Report
The popular phishing-as-a-service platform used AI throughout the attack chain, allowing cybercriminals to steal tokens for account takeover and business email compromise. The post Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud appeared first on CyberScoop.
Analysis Summary
# Incident Report: Takedown of EvilTokens Phishing-as-a-Service (PaaS)
## Executive Summary
Microsoft and a coalition of global partners disrupted "EvilTokens," a sophisticated Phishing-as-a-Service (PaaS) platform that utilized AI to automate the entire attack chain for financial fraud. The operation resulted in the seizure of 50 websites and 175 domains, effectively halting a service that compromised over 12,000 email inboxes across 10,000 organizations. Two primary operators were arrested in the UK following a coordinated investigation into the platform’s infrastructure and financial flows.
## Incident Details
- **Discovery Date:** August 2026 (Initial reporting to Metropolitan Police)
- **Incident Date:** Active February 2026 – September 2026
- **Affected Organization:** 10,000+ organizations globally (Microsoft customers)
- **Sector:** Cross-sector (Financial, Healthcare, Government, etc.)
- **Geography:** Global (Primary impact in US, Canada, UK, Australia, India, and France)
## Timeline of Events
### Initial Access
- **Date/Time:** Commencing February 2026
- **Vector:** Adversary-in-the-Middle (AiTM) Phishing
- **Details:** Use of AI-generated phishing lures to trick users into providing session tokens, bypassing Multi-Factor Authentication (MFA).
### Lateral Movement
- **Details:** Attackers utilized the Microsoft Graph API to map organizational structures, identifying executive relationships and internal permissions to expand their reach within the compromised tenant.
### Data Exfiltration/Impact
- **Details:** Automated AI chatbots analyzed victim inboxes to identify payment authorizations and sensitive financial data. Confirmed losses exceed $1.7 million, though total fraud is likely significantly higher.
### Detection & Response
- **August 2026:** Microsoft provides intelligence on platform administrators to UK authorities.
- **September 15, 2026:** Federal court order allows Microsoft to seize 50 operational websites.
- **September 18, 2026:** UK Metropolitan Police arrest two suspects in the London area.
- **September 22, 2026:** Public announcement of the disruption and disabling of 175 supporting domains.
## Attack Methodology
- **Initial Access:** Phishing-as-a-Service (PaaS) using AI-crafted lures and AiTM techniques.
- **Persistence:** Theft of session tokens to maintain access without needing to re-authenticate.
- **Privilege Escalation:** Exploiting stolen administrative tokens.
- **Defense Evasion:** Use of AI to mimic trusted communication styles and bypass standard MFA by intercepting session cookies.
- **Credential Access:** Token theft (Session hijacking).
- **Discovery:** Automated mapping of organizational charts via Microsoft Graph.
- **Lateral Movement:** API-based exploration of tenant resources.
- **Collection:** AI-driven analysis of email content to identify high-value financial targets.
- **Impact:** Financial fraud via Business Email Compromise (BEC).
## Impact Assessment
- **Financial:** At least $1.7 million in reported FBI IC3 losses; $1.1 million in illicit revenue generated for the PaaS operators.
- **Data Breach:** Over 12,000 individual email inboxes compromised.
- **Operational:** Massive disruption across 10,000+ organizations requiring token revocation and password resets.
- **Reputational:** Significant brand damage to affected organizations and increased distrust in digital communications.
## Indicators of Compromise
- **Network Indicators:**
- evil-tokens[.]com (Defanged example)
- 175+ supporting phishing domains (Disabled)
- **Behavioral Indicators:**
- Unauthorized Microsoft Graph API calls for organizational mapping.
- Token usage originating from unexpected geographic locations or known VPN/proxy ranges.
- AI-style chatbot interactions observed in backend service logs.
## Response Actions
- **Containment:** Court-ordered seizure of domains and IP infrastructure.
- **Eradication:** Disabling of active malicious accounts and suspension of Telegram-based sales channels.
- **Recovery:** Notification of 10,000 affected organizations to secure compromised tenants.
## Lessons Learned
- **AI as a Force Multiplier:** Attackers are no longer just using AI for writing emails; they are using it to automate target selection and financial analysis.
- **MFA Vulnerability:** Standard MFA is increasingly vulnerable to session token theft via AiTM, necessitating a shift toward phishing-resistant MFA (e.g., FIDO2).
- **Global Collaboration:** The speed of the takedown was enabled by public-private partnerships involving tech giants, cybersecurity firms, and international law enforcement.
## Recommendations
- **Phishing-Resistant MFA:** Implement hardware security keys or certificate-based authentication to prevent token theft.
- **Conditional Access:** Apply strict policies to limit session lifetimes and restrict access to trusted devices/locations.
- **API Monitoring:** Monitor Microsoft Graph and other cloud APIs for anomalous reconnaissance activity.
- **AI Defense:** Deploy AI-driven security tools to counter AI-driven threats by identifying non-human communication patterns.