Cases › security breach › LR-2026-0713
EvilTokens AI-assisted device code phishing service disrupted by Microsoft
Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: fix reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity major: test met: many third parties, with a stated count of over 10,000 organizations affected.
Microsoft announced on 22 September 2026 that it had taken down EvilTokens, a phishing-as-a-service platform that it said used AI at every step of the attack chain. Its chatbot could analyze a victim's inbox to help criminals identify trusted relationships and payment authorizations, and could recommend fraud strategies, including impersonating messages. Victims were tricked into entering a device code on Microsoft's real sign-in page, which gave attackers access to their email accounts. Statistics shared by Microsoft linked the service to more than 12,000 compromised email inboxes across over 10,000 organizations. Microsoft and partners seized 50 websites and disabled over 150 additional domains, and two men were arrested by the Metropolitan Police Service on 11 September 2026.
What happened
What was done
“The web infrastructure and security company said the EvilTokens developers used domains purchased and set up by a third-party based in another country, and that it banned hundreds of domains and Workers projects, as well as killed Worker scripts and suspended accounts as part of the enforcement effort.”
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Read from the sources; not yet reviewed by a person.
Controls
Infrastructure / targetNot effective (bypassed) Phishing and fraud filters
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
Other controls for this risk at this layer, not mentioned in the sources: Safety training and refusal, Cyber and weapons safeguards, Abuse monitoring and account enforcement, Staged or restricted release, Dangerous-capability testing before release, Outside red-teaming, Content safety classifiers, Safeguards kept on in testing, Reasoning monitoring.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationThe attackerDeployer
The attacker ran the agent; this layer was the attacker's own.
L4 · Infrastructure / targetOrganisation hit
Other controls for this risk at this layer, not mentioned in the sources: Known flaws patched, Multi-factor sign-in and password policy, Network segmentation, Intrusion and endpoint detection, Backups and recovery.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Content safety classifiers | L1 Model | Not stated in sources |
| Safety training and refusal | L1 Model | Not stated in sources |
| Cyber and weapons safeguards | L1 Model | Not stated in sources |
| Dangerous-capability testing before release | L1 Model | Not stated in sources |
| Outside red-teaming | L1 Model | Not stated in sources |
| Staged or restricted release | L1 Model | Not stated in sources |
| Abuse monitoring and account enforcement | L1 Model | Not stated in sources |
| Reasoning monitoring | L1 Model | Not stated in sources |
| Safeguards kept on in testing | L1 Model | Not stated in sources |
| Phishing and fraud filters | L4 Infrastructure / target | Not effective (bypassed) |
| Known flaws patched | L4 Infrastructure / target | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not stated in sources |
| Network segmentation | L4 Infrastructure / target | Not stated in sources |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not stated in sources |
| Backups and recovery | L4 Infrastructure / target | Not stated in sources |
Evidence
- What was done seized 50 websites and disabled over 150 additional domains
No source states: how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, any court case, the cause, what set it off, what was done.
Show the full account: 5 items from the primary sources
What happened, in order
- 2025-10 to 2026-06 Period over which Coinbase traced platform revenue and deposits to EvilTokens.
- 2026-03 Sekoia report characterized EvilTokens as sold on Telegram since mid-February 2026.
- 2026-03 Huntress first documented EvilTokens as a phishing-as-a-service platform.
- 2026-04 Sekoia published a follow-up report on the device code phishing kit.
- 2026-09-11 Metropolitan Police Service arrested two men in connection with the operation.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
Controls for the chatbot's safeguards (refusal, monitoring) are not stated and were not reported.
LR-2026-0713 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON