EvilTokens Seized: AI Phishing Bypassed MFA on 12,000 Inboxes
Microsoft seized 50 websites and more than 150 supporting domains on September 22, 2026, dismantling the phishing-as-a-service platform EvilTokens, which had bypassed MFA on 12,000 email accounts acro…