EvilTokens is a phishing-as-a-service (PhaaS) platform that emerged in February 2026 and was disrupted by Microsoft's Digital Crimes Unit with law enforcement partners on September 22, 2026. Sold on Telegram by the actor Microsoft tracks as Storm-2992 for a $1,500 initiation fee plus $500 per month, it abused Microsoft's OAuth device code authentication flow to steal tokens and bypass MFA, then used built-in AI assistants to read compromised inboxes, pick high-value targets and draft follow-on business email compromise messages. Microsoft says it compromised more than 12,000 inboxes across more than 10,000 organizations.

How did EvilTokens bypass multi-factor authentication?

Through device code phishing. The attacker starts a legitimate device code sign-in, receives a short code, and delivers it to the victim inside a phishing lure disguised as an invoice, RFP or shared file. When the victim enters the code on Microsoft's real login page and completes MFA, they authorize the attacker's session, not their own. No password is captured and MFA is satisfied, so the attacker receives valid access and refresh tokens. Those tokens are then used to exfiltrate mail, create hidden inbox rules and register new devices for persistence.

What did Microsoft do to disrupt EvilTokens?

With authorization from the U.S. District Court for the Eastern District of Virginia, Microsoft's Digital Crimes Unit seized 50 websites used to run the service and disabled more than 175 supporting domains. The UK's Metropolitan Police arrested two suspected administrators, aged 32 and 38, on September 11, 2026. Microsoft coordinated with Health-ISAC and identity intelligence firm SpyCloud. Victims were concentrated in the United States, Canada, the United Kingdom, Australia, India and France across wholesale distribution, construction, financial services, real estate, higher education and healthcare.

How do I protect my organization from EvilTokens-style attacks?

Microsoft's top recommendation is to block the device code authentication flow in Entra Conditional Access wherever it is not needed, scoping exceptions to specific Teams device accounts. Beyond that: move to phishing-resistant MFA (FIDO2 keys or passkeys), block legacy authentication, enable sign-in risk policies with continuous access evaluation, alert on suspicious inbox-rule creation, and on suspected compromise temporarily disable the account rather than only revoking sessions, because access tokens can stay valid for up to an hour after refresh tokens are revoked.

Quick Answer

What Is EvilTokens? AI Phishing Kit Microsoft Took Down

Published: September 24, 2026

The short answer

EvilTokens was the most widely used AI-assisted phishing-as-a-service platform of 2026 until Microsoft dismantled it on September 22, 2026. Launched in February 2026 and sold on Telegram by the actor Microsoft tracks as Storm-2992, the kit turned device code phishing into a subscription product: $1,500 up front, $500 a month, with an AI assistant that wrote target-specific lures, and post-compromise AI tooling that read the victim’s mailbox, mapped their organization through Microsoft Graph and drafted the next impersonation email. Microsoft counts more than 12,000 compromised inboxes in more than 10,000 organizations. The disruption seized 50 sites and 175 domains, and UK police arrested two suspected administrators.

What EvilTokens actually did

The kit chained four stages that used to require a skilled human operator.

Stage	What EvilTokens automated
Lure	44 email themes (invoices, RFPs, shared files) with malicious URLs, PDFs or HTML attachments; an AI assistant to tailor copy to the target
Evasion	Fake CAPTCHA gates, redirect chains through compromised domains and serverless hosts (Vercel, Cloudflare Workers, AWS Lambda), an “Antibot” redirector sold as an add-on
Token theft	Device code phishing: the attacker’s session is authorized when the victim enters the code on Microsoft’s real sign-in page
Post-compromise	AI reads the mailbox, identifies payment authorities and relationships, drafts BEC messages; Graph reconnaissance maps org structure; inbox rules hide replies; new devices registered for persistence

The panel let subscribers pick a deployment method (Cloudflare Workers/Bunny or PHP hosting), capture mode, template, language, CAPTCHA and an explicit “AI Mode” toggle. Add-on products included a B2B Sender, an Office 365 capture link and an SMTP sender, each billed separately for 30-day access.

Why device code phishing works against MFA

Device code flow is a legitimate OAuth pattern for devices with no keyboard: smart TVs, printers, Teams Rooms hardware. The device shows a short code, the user types it into a browser on their phone or laptop, and the device gets a token. The security tradeoff is that authentication happens on a different device from the one requesting access, so the session is not strongly bound to the user’s context.

EvilTokens exploited that gap. The attacker initiates the flow, harvests the code, and delivers it inside the lure. The victim lands on Microsoft’s own login page, enters the code, completes MFA, and unknowingly authorizes the attacker. Nothing looks fake, because nothing is. Microsoft observed an April 2026 campaign aligned with EvilTokens that spun up thousands of short-lived Node.js polling nodes on automation platforms to generate codes dynamically and evade signature-based detection.

What “AI-powered” means here

This is the part that separates EvilTokens from the AiTM kits of 2024 and 2025. Generative AI was not only polishing grammar. According to Microsoft’s September 22, 2026 analysis, the platform used AI to:

Structure target-specific emails from a prebuilt template library, in the victim’s language.
Sift compromised mailboxes to find who approves payments, which vendors are in mid-negotiation and which threads to hijack.
Engineer follow-on phishing based on the actual email content the attacker could now read.

That collapses the expertise barrier for business email compromise. An affiliate with no social-engineering background could buy the kit, point it at a distribution company and let the AI decide whom to impersonate. It is the same shift Cisco Talos described the same day with CLOSEDQUORUM, where malware outsources tactical decisions to LLMs: the human operator is being removed from the loop on the offensive side too.

The takedown

Legal action: authorization from the U.S. District Court for the Eastern District of Virginia; 50 websites seized, more than 175 domains disabled.
Arrests: the Metropolitan Police Service arrested two men, aged 32 and 38, on September 11, 2026.
Partners: Health-ISAC and SpyCloud worked with Microsoft’s Digital Crimes Unit.
Attribution: Storm-2992, which developed and supported the kit and sold it through Telegram bots and channels.

Disruptions of PhaaS platforms rarely end the threat. The affiliates keep their stolen tokens until those are revoked, and the operators often rebrand. What changes is the economics: the panel, templates and hosting integrations are gone, and anyone who paid $1,500 for the kit has to find a new one.

What defenders should do this week

Microsoft’s guidance is specific, and most of it costs nothing:

Block device code flow in Entra Conditional Access unless you have a documented need. If you run Teams devices, scope the exception to those resource accounts and exclude the Device Registration Service.
Move to phishing-resistant MFA: FIDO2 keys or passkeys via Microsoft Authenticator. Telephony MFA is vulnerable to SIM swapping and does nothing against device code phishing.
Block legacy authentication, which cannot enforce MFA at all.
Turn on sign-in risk policies and continuous access evaluation so high-risk sessions are revoked automatically.
Alert on new inbox rules, especially ones that move or delete mail; that is the persistence signature of BEC.
On compromise, disable the account temporarily. Revoking sessions invalidates refresh tokens but leaves access tokens live for up to an hour, and EvilTokens operators worked inside that window.

For the step-by-step version, including how to test whether your tenant still allows device code flow, see How to defend against AI phishing and device code attacks.

Context: AI on both sides of the wire

EvilTokens landed in a week where Cisco Talos disclosed the first LLM-driven autonomous malware, Palo Alto Networks Unit 42 launched a multi-model defensive harness, and Microsoft’s own report leaned on Security Copilot hunting queries and Defender XDR detections to find the kit’s traffic. The offensive tooling is now a software business with subscriptions and customer support; the defensive answer is identity hygiene that removes the attack surface altogether. Blocking device code flow ends this entire kit’s primary technique.

Last verified: September 24, 2026.