Microsoft disrupts EvilTokens phishing service

Microsoft has led a coordinated operation against the infrastructure behind EvilTokens, a phishing-as-a-service platform it says was used to compromise more than 12,000 inboxes at upwards of 10,000 organisations worldwide. Two men, aged 32 and 38, were arrested in London on suspicion of administering the service.

What EvilTokens actually did

The platform abused the device code authentication flow, a legitimate part of Microsoft’s OAuth 2.0 sign-in system that exists for devices without a keyboard - smart televisions, printers, conferencing kit and some Teams hardware. In that flow the user is handed a short code, opens a browser on another device and types it in. An attacker who starts the flow themselves can hand the victim their own code, and the victim then authorises the attacker’s session believing they are signing in to something routine.

Because no password is typed on the compromised device, there is nothing for multi-factor authentication to challenge. Microsoft says EvilTokens was the first service to sell this technique at scale, launched in February 2026, and it added AI features that tailored the lures and sorted through stolen mailboxes to find the accounts worth breaking into next. The kit was sold through Telegram at $500 a month or $1,500 outright, with 44 ready-made phishing kits and extras such as anti-bot redirectors sold separately.

The scale, and the UK connection

Microsoft puts the damage at more than 12,000 compromised inboxes across over 10,000 organisations, with victims concentrated in wholesale distribution, construction, financial services, real estate, higher education and healthcare. SpyCloud, which recaptured phished data and worked on the operation, records 8,708 compromised accounts across 6,585 corporate email domains in 79 countries, roughly 97.5 per cent of them enterprise addresses. The most targeted countries are the United States, Canada, Australia, the United Kingdom and Saudi Arabia.

The UK element is not incidental. The Metropolitan Police Service received information about the suspects in August and executed warrants on Friday at addresses in Canary Wharf and Nine Elms. Both men have been released on bail pending further investigation. “The Met remains committed to holding people to account who facilitate criminal enabling functions and think they can remain undetected,” Detective Inspector Serena D’Adamo told BleepingComputer.

Microsoft’s Digital Crimes Unit worked with law enforcement, the Health-ISAC and SpyCloud, and obtained legal authority to seize active infrastructure belonging to the service. That is not the same as shutting it down: the reporting is explicit that this was not a takedown, that the threat remains active, and that clone services such as APToken have already appeared.

What defenders are being told to change

Microsoft’s guidance is unusually blunt for a vendor whose own sign-in system hosts the weakness. Organisations should block the device code flow wherever it is not needed, and where Teams hardware genuinely needs it, scope the exception to specific resource accounts. Beyond that it repeats the standard list: monitor sign-in risk reports, use phishing-resistant authentication such as FIDO2 keys or passkeys rather than telephony-based codes, and teach users to check which application they are approving.

Our opinion

Device code phishing deserves more attention than it gets, because it inverts the comfortable story organisations tell themselves about MFA. Nothing is phished in the sense people expect - no password, no one-time code intercepted, no fake login page that only a careful employee would spot, because the page really is Microsoft’s. The sign-in is genuine and the token is real; it just belongs to somebody else. Security training built around spotting a wrong URL has nothing to say about that, which is why the answer has to be turning the flow off where it is not needed rather than hoping people read the prompt carefully.

The London arrests are the more interesting signal. Phishing-as-a-service is a business, and businesses have administrators, payment pages and premises - which makes them findable in a way that a lone operator in a jurisdiction nobody can reach is not. The sober reading of the same facts is that seizing infrastructure and bailing two suspects has left the platform active and its clones untouched, so the disruption is really a statement about enforcement reach rather than a cure. Both things are true at once, and the second one is the reason the device code flow still needs switching off tonight.