Microsoft and partners disrupted “EvilTokens,” a phishing service that helped criminals break into more than 12,000 mailboxes across 10,000+ organizations. Victims were tricked into entering an authentication code on a real Microsoft sign-in page, letting attackers capture access tokens and get into inboxes without stealing passwords. Once inside, an AI chatbot analyzed emails to identify finance workflows and the best people to impersonate for fraud.
EvilTokens operated as a phishing service that compromised more than 12,000 inboxes at over 10,000 organizations. Rather than stealing passwords outright, the scheme relied on tricking victims into entering an authentication code on Microsoft's legitimate sign-in page. By completing what looked like a routine MFA step, victims unknowingly handed over access tokens and sessions to attackers, all without ever revealing their actual password.
Once inside a mailbox, the service reportedly included an AI chatbot capable of summarizing and translating emails, identifying financial conversations, mapping organizational roles, and suggesting the best people to impersonate. Preset prompts were built around fraud enablement, such as locating wire transfer discussions, vendor invoices, and an organization's 'money movers.'
The technique succeeded because it exploited a step users are trained to trust: entering a code on a real sign-in page. Because the phishing flow used Microsoft's legitimate authentication page, there was no obviously fake login form to spot. This let attackers capture session tokens directly, sidestepping the need to guess or steal a password at all.
The persistence of this access compounds the problem. Access could persist even after a password reset if the associated sessions and tokens were not also revoked, meaning standard credential-reset procedures alone were not sufficient to remove an attacker from a compromised account.
Organizations should treat unexpected authentication code prompts as high risk and avoid entering codes triggered by an email link, navigating to sign-in pages directly instead. Because compromised inboxes can be understood by attackers within minutes, incident response should move quickly and include full session and token revocation, not just a password reset.
Finance, accounts payable, and procurement staff should independently verify requests to change payment information, redirect funds, or approve unusual transactions through a trusted second channel, regardless of how legitimate the email thread appears. Building this verification habit reduces the payoff for attackers even if an inbox is compromised.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
EvilTokens was a phishing service disrupted by Microsoft and partners that compromised more than 12,000 inboxes at over 10,000 organizations by capturing authentication codes and tokens instead of passwords.
Victims were tricked into entering an authentication code on Microsoft's legitimate sign-in page, which handed over access tokens and sessions to attackers without ever exposing the actual password.
Not necessarily. Access could persist even after a password reset if the associated sessions and tokens were not also revoked.
An AI chatbot inside the service analyzed emails to find wire transfer discussions, vendor invoices, and 'money movers,' then suggested the best contacts to impersonate for payment fraud.
EvilTokens hijacked over twelve thousand inboxes by abusing one thing we trust most: our MFA code. You click, land on the real Microsoft sign-in page, and type the authentication code to 'stop' the attack. That normal step silently hands over access tokens, so they get into your mailbox without ever knowing your password, and can stay in even after a password reset. Inside your inbox, EvilTokens used an AI chatbot to summarize threads, find wire transfers, vendor invoices, and your 'money movers,' then draft emails that sound exactly like your colleagues: 'Hi, we need to update payment details for the next invoice…' Your move: if you ever get a surprise Microsoft security alert asking for a code, don’t enter it from that email. Close it, go to portal.office.com or microsoft365.com yourself, and handle sign-in and codes only there.
Microsoft says it disrupted “EvilTokens,” an AI-assisted phishing service used to trick employees into authorizing attacker access via the device-code login flow (often used for TVs/printers). Victims who entered an attacker-provided code in their browser unknowingly granted access tokens that…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service operation linked to more than 12,000 compromised Microsoft email inboxes across 10,000+ organizations. The service used AI to pick targets, impersonate trusted contacts, and steal session tokens so criminals could stay in…
EvilTokens was a phishing-as-a-service operation that used “device code phishing” to trick employees into authorizing an attacker session on Microsoft’s real login infrastructure, often bypassing MFA without stealing passwords. After access, attackers used AI to find payment-related conversations…
Microsoft and UK police took down “EvilTokens,” an AI-powered phishing service sold on Telegram that helped criminals compromise email accounts and then rapidly find the best ways to commit fraud. The service could analyze a victim’s inbox to identify trusted relationships and financial workflows,…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
