Microsoft and UK police took down “EvilTokens,” an AI-powered phishing service sold on Telegram that helped criminals compromise email accounts and then rapidly find the best ways to commit fraud. The service could analyze a victim’s inbox to identify trusted relationships and financial workflows, then recommend impersonation messages and fraud strategies. A key tactic highlighted was “device code phishing,” where victims enter a short code that unknowingly authorizes an attacker session without sharing a password.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Microsoft just helped take down an AI phishing service called EvilTokens that hit over ten thousand organizations. EvilTokens scanned stolen inboxes, spotted who moves money, then sent perfect fake invoices and file‑sharing emails that looked exactly like your vendor or partner. Here’s the sneaky part: device code phishing. You get an email with a short sign‑in code and a link. You type it in, no password asked, and you’ve just approved the criminal’s session into your account. If you ever get a device or login code you didn’t start, stop and report it to IT immediately, do not enter that code anywhere.
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service operation linked to more than 12,000 compromised Microsoft email inboxes across 10,000+ organizations. The service used AI to pick targets, impersonate trusted contacts, and steal session tokens so criminals could stay in…
Microsoft and partners disrupted “EvilTokens,” a phishing service that helped criminals break into more than 12,000 mailboxes across 10,000+ organizations. Victims were tricked into entering an authentication code on a real Microsoft sign-in page, letting attackers capture access tokens and get…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
Microsoft says it disrupted “EvilTokens,” an AI-assisted phishing service used to trick employees into authorizing attacker access via the device-code login flow (often used for TVs/printers). Victims who entered an attacker-provided code in their browser unknowingly granted access tokens that…
EvilTokens was a phishing-as-a-service operation that used “device code phishing” to trick employees into authorizing an attacker session on Microsoft’s real login infrastructure, often bypassing MFA without stealing passwords. After access, attackers used AI to find payment-related conversations…
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
