EvilTokens Phishing Disrupted After 12,000 Microsoft Accounts Compromised

Microsoft and its partners have disrupted EvilTokens phishing infrastructure after the service compromised more than 12,000 accounts across over 10,000 organizations. The operation remains active, although Microsoft expects the intervention to reduce attack volume.

UK police have also arrested two men suspected of administering the phishing service. Both were released on bail while the investigation continues.

Microsoft and Partners Seize EvilTokens Infrastructure

Microsoft’s Digital Crimes Unit coordinated the action with Health-ISAC, law enforcement and identity security company SpyCloud. The partners obtained legal authority to seize active infrastructure associated with EvilTokens.

Microsoft tracks the group behind the service as Storm-2992. Its campaigns affected organizations in sectors including healthcare, financial services, construction and higher education.

SpyCloud separately identified more than 8,700 compromised accounts across 6,585 corporate email domains in 79 countries. These figures come from its recovered phishing data and describe a different dataset from Microsoft’s total.

Device-Code Phishing Bypasses the Need to Steal Passwords

EvilTokens specializes in device-code phishing. The technique misuses a legitimate Microsoft sign-in process designed for devices with limited input options.

An attacker requests a device code and sends it to a target through a phishing message. The target then enters the code and signs in through Microsoft’s legitimate login page. That action can grant the attacker an authentication token, even when the account uses multifactor authentication.

The service offered customizable lures that impersonated document-signing tools, file-sharing services, invoices and Microsoft products. Its operators advertised access through Telegram for $500 per month or a one-time fee of $1,500.

Stolen Inbox Access Fuels Further Fraud

After gaining access, EvilTokens used Microsoft Graph to examine organizational relationships. Its AI-powered tools could also search inboxes for invoices, wire-transfer details and executive correspondence.

Attackers could use those findings to identify valuable targets and write convincing business email compromise messages. According to SpyCloud, roughly 97.5% of the compromised accounts in its dataset belonged to enterprise domains.

The Threat Remains Active

The infrastructure seizure disrupted EvilTokens, but it did not eliminate the service. Other device-code phishing platforms also exist, and affiliates have created similar tools.

Organizations can reduce exposure by disabling device-code authentication where they do not need it and monitoring for suspicious sign-ins. Users should check which application requests access before completing an unexpected device-code sign-in.