{"schema_version":"0.10.0","id":"LR-2026-0713","record_version":1,"title":"EvilTokens AI-assisted device code phishing service disrupted by Microsoft","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":45.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.8,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"ac1280aee3db8b04969375111d710499a08beb96cdf62a62cd703a7d8d26aac4"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-22","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Microsoft announced on 22 September 2026 that it had taken down EvilTokens, a phishing-as-a-service platform that it said used AI at every step of the attack chain. Its chatbot could analyze a victim's inbox to help criminals identify trusted relationships and payment authorizations, and could recommend fraud strategies, including impersonating messages. Victims were tricked into entering a device code on Microsoft's real sign-in page, which gave attackers access to their email accounts. Statistics shared by Microsoft linked the service to more than 12,000 compromised email inboxes across over 10,000 organizations. Microsoft and partners seized 50 websites and disabled over 150 additional domains, and two men were arrested by the Metropolitan Police Service on 11 September 2026.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"seized 50 websites and disabled over 150 additional domains","precursor_events":null,"primary_risk":"RK07","secondary_risks":["RK03","RK19"],"control_chain":[{"layer":"L4","party":"target","party_name":null,"control_id":"J9","outcome":"got_around","reason":null,"quote":"Simultaneously, EvilTokens employs a multi-stage delivery pipeline to bypass traditional email gateways and endpoint security through fake CAPTCHA checks and redirection chains that make use of high-reputation \"serverless\" platforms like Vercel, Cloudflare Workers, and AWS Lambda to blend in with legitimate enterprise cloud traffic and sidestep domain-blocklist triggers.","source_index":0,"reviewed":false}],"remediations":[{"by":null,"kind":"fix","date_reported":null,"controls_added":["D7"],"quote":"The web infrastructure and security company said the EvilTokens developers used domains purchased and set up by a third-party based in another country, and that it banned hundreds of domains and Workers projects, as well as killed Worker scripts and suspended accounts as part of the enforcement effort.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major test met: many third parties, with a stated count of over 10,000 organizations affected.","harm_class":[],"affected_description":"email accounts of victims in more than 10,000 organizations worldwide","protected_class_involved":null,"data_categories_exposed":["email"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.html","publisher":"The Hacker News","date":"2026-09-22","type":"press","title":"Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.detection_method":"C","event.adversarial_actor":"C","event.remediation":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"EvilTokens helped criminals gain access to email accounts by tricking victims into entering an authentication code on Microsoft's legitimate sign-in page."}],"event.detection_method":[{"source_index":0,"quote":"EvilTokens was first documented by Huntress in March 2026 as a phishing-as-a-service (PhaaS) platform that abused the OAuth 2.0 device authorization flow to give attackers authenticated sessions with victim accounts without having to supply any credentials at their end."}],"event.adversarial_actor":[{"source_index":0,"quote":"Microsoft is tracking the threat actors behind the development and support of EvilTokens as Storm-2992."}],"event.remediation":[{"source_index":0,"quote":"Microsoft said it worked with other partners to seize 50 websites used to operate the service and disable over 150 additional domains associated with its supporting infrastructure."}],"impact.affected_description":[{"source_index":0,"quote":"Statistics shared by Microsoft show that EvilTokens has been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide, indicating the service had gained widespread traction among threat actors in a short span of time."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The stolen tokens are abused for email exfiltration and persistence, often by setting malicious inbox rules that conceal communications."}],"impact.severity":[{"source_index":0,"quote":"Statistics shared by Microsoft show that EvilTokens has been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide, indicating the service had gained widespread traction among threat actors in a short span of time."}],"impact.severity_because":[{"source_index":0,"quote":"Statistics shared by Microsoft show that EvilTokens has been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide, indicating the service had gained widespread traction among threat actors in a short span of time."}],"event.control_chain":[{"source_index":0,"quote":"Simultaneously, EvilTokens employs a multi-stage delivery pipeline to bypass traditional email gateways and endpoint security through fake CAPTCHA checks and redirection chains that make use of high-reputation \"serverless\" platforms like Vercel, Cloudflare Workers, and AWS Lambda to blend in with legitimate enterprise cloud traffic and sidestep domain-blocklist triggers."}],"event.remediations":[{"source_index":0,"quote":"The web infrastructure and security company said the EvilTokens developers used domains purchased and set up by a third-party based in another country, and that it banned hundreds of domains and Workers projects, as well as killed Worker scripts and suspended accounts as part of the enforcement effort."}],"event.summary":[{"source_index":0,"quote":"Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) \"at every step of the attack chain.\""},{"source_index":0,"quote":"The platform could even recommend fraud strategies, including drafting messages that impersonated trusted contacts to help criminals trick victims into taking action."},{"source_index":0,"quote":"EvilTokens helped criminals gain access to email accounts by tricking victims into entering an authentication code on Microsoft's legitimate sign-in page."},{"source_index":0,"quote":"Statistics shared by Microsoft show that EvilTokens has been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide, indicating the service had gained widespread traction among threat actors in a short span of time."},{"source_index":0,"quote":"Microsoft said it worked with other partners to seize 50 websites used to operate the service and disable over 150 additional domains associated with its supporting infrastructure."}]},"notes_on_gaps":"Single source (The Hacker News, 2026-09-22, relaying Microsoft, Cloudflare, SpyCloud, Sekoia and TRM Labs statements). The sources do not say the chatbot was an autonomous agent, so agent_involved, failure_class, autonomy_level and the model fields are left out. No model name, version or developer is stated. Date of occurrence is not stated; the 2026-02-18 SpyCloud capture date is not treated as the incident date. date_detected uses the March 2026 Huntress documentation as the nearest detection date, which is a judgement. The 2026-09-22 disclosure date is the article date, consistent with 'on Tuesday'. impact.third_parties_affected_count uses 10000 from 'over 10,000 organizations', a lower bound. The 8,708 SpyCloud accounts were not entered as records_exposed because the source does not frame them as exposed records. Dollar figures for criminal pricing and revenue were not entered as impact.direct_loss_usd since no loss to a victim was stated. Root cause, trigger and responsible party are not stated and were left out. Controls for the chatbot's safeguards (refusal, monitoring) are not stated and were not reported. The Cloudflare enforcement is a remediation by a third party on the criminal infrastructure, so the D7 control entry is a judgement. Context industry and country are not single values in the sources and were left out. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The service's AI tools let customers summarize and translate stolen emails, map organisational roles, identify trusted relationships and recommend targets.","quote":"Other AI-related tools allowed its customers to summarize and translate emails, map organizational roles, identify trusted relationships, and recommend potential targets.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Victims were tricked into entering a device code on Microsoft's real sign-in page, giving attackers authenticated access to their email.","quote":"EvilTokens helped criminals gain access to email accounts by tricking victims into entering an authentication code on Microsoft's legitimate sign-in page.","source_index":0,"grade":"C"},{"step":"reached","text":"Microsoft's statistics link the service to more than 12,000 compromised email inboxes across over 10,000 organizations.","quote":"Statistics shared by Microsoft show that EvilTokens has been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide, indicating the service had gained widespread traction among threat actors in a short span of time.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.html"]},"analysis":{"sections":{"timeline":[{"text":"Period over which Coinbase traced platform revenue and deposits to EvilTokens.","quote":"Coinbase said it traced approximately $1.1 million in platform revenue across four Tron addresses between October 2025 and June 2026, adding that it identified more than 1,000 deposits to EvilTokens from over 700 distinct addresses across the crypto ecosystem.","source_index":0,"when":"2025-10 to 2026-06"},{"text":"Sekoia report characterized EvilTokens as sold on Telegram since mid-February 2026.","quote":"In a report published in late March 2026, Sekoia characterized EvilTokens as a turnkey solution sold under a PhaaS model on Telegram since mid-February, offering customers a plethora of self-hosted phishing templates and AI-powered features to automate business email compromise (BEC) workflows, such as analyzing harvested emails, identifying finance-related email threads, and drafting BEC emails.","source_index":0,"when":"2026-03"},{"text":"Huntress first documented EvilTokens as a phishing-as-a-service platform.","quote":"EvilTokens was first documented by Huntress in March 2026 as a phishing-as-a-service (PhaaS) platform that abused the OAuth 2.0 device authorization flow to give attackers authenticated sessions with victim accounts without having to supply any credentials at their end.","source_index":0,"when":"2026-03"},{"text":"Sekoia published a follow-up report on the device code phishing kit.","quote":"Sekoia explained in a follow-up report in April 2026.","source_index":0,"when":"2026-04"},{"text":"Metropolitan Police Service arrested two men in connection with the operation.","quote":"In tandem, the Metropolitan Police Service arrested two men, aged 32 and 38, on September 11, 2026, in connection with the illicit commercial operation.","source_index":0,"when":"2026-09-11"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.html"]}}