Microsoft Disrupts EvilTokens, a Subscription Phishing Service Using AI

Microsoft has disrupted infrastructure used by EvilTokens, a subscription service that helped criminals carry out device-code phishing attacks. Axios reported September 22 that the U.S. District Court for the Eastern District of Virginia authorized the takedown. Microsoft said the operation was linked to more than 12,000 compromised email inboxes across roughly 10,000 organizations.

EvilTokens lowered the barrier to running phishing campaigns by selling access to tools and services. Reporting described a fee of $1,500 to start and $500 per month. The affected organizations spanned sectors including finance, construction, education, real estate, and healthcare.

Taking down infrastructure is one step

A court-authorized disruption can make a service harder to use, but it does not end the underlying threat. Operators may rebuild, shift domains, or move to another platform. Microsoft said law enforcement investigations were continuing.

The case also illustrates why “AI-powered” needs context. AI can help cybercriminals scale parts of an operation, but the immediate attack path here involved device-code phishing, where a victim is tricked into authorizing access. Organizations still need controls that address the technique itself: employee awareness, authentication policies, monitoring for unusual sign-ins, and a rapid way to revoke compromised sessions.

For defenders, the story is a reminder to watch the criminal service economy as well as individual attackers. Disrupting the infrastructure behind phishing can raise the cost of abuse, while incident response and identity security remain essential when campaigns reach inboxes.

Sources: Axios reporting on the court-authorized action; Microsoft’s account of its broader cybercrime-disruption work.