Device-code phishing, an AI mailbox analyst and 12,000 hijacked inboxes: what the takedown removed, and what it didn’t.
Microsoft’s Digital Crimes Unit has knocked out the infrastructure behind EvilTokens, a phishing-as-a-service platform that the company says compromised more than 12,000 inboxes at over 10,000 organizations since it appeared in February. Acting on an order from the US District Court for the Eastern District of Virginia, Microsoft and Health-ISAC seized 50 websites used to run the service and disabled more than 150 domains tied to it, with help from Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, the Shadowserver Foundation and TRM Labs.
In the UK, the Metropolitan Police arrested two men, aged 32 and 38, on suspicion of running the operation. Both have been released on bail while the investigation continues. Microsoft tracks the crew behind the service as Storm-2992.
No password required #
The unusual part is how EvilTokens got in. It never stole a credential. Instead it abused the OAuth 2.0 device-code flow, the sign-in method built for hardware without a proper keyboard: smart TVs, printers, conference-room kit. The attacker requests a device code, wraps it in a phishing lure, and the victim types it into Microsoft’s real login page. Everything looks legitimate because it is. The victim even completes MFA personally, and in doing so hands the attacker a token for their mailbox.
That token is the real problem. Steven Masada, who runs the Digital Crimes Unit, warned that the access “could persist even after a password reset” if the associated sessions and tokens weren’t revoked too. The reflexive response to a phish, changing the password, does nothing here on its own.
An analyst for hire, built in #
Once inside, the service used Microsoft Graph to map who works with whom and fed the mailbox to an AI chatbot. Preset prompts hunted for wire-transfer threads, pending vendor invoices and what Microsoft calls the organization’s “money movers,” then suggested who to impersonate and drafted messages in the voice of a trusted contact. According to Microsoft, it sold on Telegram for a $1,500 initiation fee plus a recurring $500 subscription, with 44 customizable phishing kits and paid add-ons such as anti-bot redirectors. The lures posed as e-signature requests, voicemail and eFax notices, invoices and password-expiry warnings.
That packaging is the shift worth paying attention to. Business email compromise used to need someone who understood identity attacks, cloud tenants, social engineering and payment fraud. EvilTokens put all four behind one dashboard, and Microsoft’s advice is to assume that once an inbox falls, criminals “may understand its contents in minutes.”
What the seizure doesn’t fix #
This was a disruption, not an ending. As BleepingComputer points out, the threat is still active at lower volume, and affiliates have already built clones. Device-code phishing exploded this year; by April at least ten kits supported it. SpyCloud’s recovered data alone counts 8,708 compromised accounts across 6,585 corporate email domains in 79 countries, and roughly 97.5% of them sat on business domains. Home users were never the target.
For admins, the fixes are unglamorous. Block the device-code flow anywhere it isn’t needed, revoke sessions and refresh tokens (not just passwords) after a suspected compromise, and move staff toward phishing-resistant sign-in such as FIDO2 keys or passkeys. For everyone else, one habit covers most of it: if an email asks you to paste a code into a Microsoft sign-in page for a device you aren’t setting up, stop. And as Help Net Security relays from Microsoft, any request to change payment details deserves a phone call to a number you already have on file.