A joint operation involving Microsoft, law enforcement, and several tech companies led to the shutdown of the EvilTokens phishing-as-a-service platform. Authorities arrested two men, aged 32 and 38, who are currently released on bail pending further investigation.
The operation resulted in the disabling of 50 websites and the blocking of 150 domains. Participating organizations included Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, TRM Labs, and Health-ISAC, alongside the London police cybercrime unit.
EvilTokens emerged in February 2026 and operated on a subscription model, costing $1,500 initially plus a monthly fee of $500. The tool featured an AI assistant that analyzed compromised mailboxes to identify high-value targets and suggest interaction strategies.
The platform enabled attackers to intercept session tokens and multi-factor authentication codes. Microsoft reported that the service facilitated the compromise of over 12,000 email accounts across more than 10,000 organizations in sectors including finance, real estate, and healthcare.
