Microsoft's Digital Crimes Unit dismantled the infrastructure of EvilTokens, a phishing-as-a-service platform identified internally as Storm-2992. The operation affected over 12,000 Microsoft 365 accounts across more than 10,000 organizations worldwide.
Two UK-based administrators, aged 32 and 38, were arrested in a joint effort involving Health-ISAC, SpyCloud, and local law enforcement. Both suspects were released on bail as the investigation continues.
The platform, which launched on Telegram in mid-February 2026, utilized a device authorization grant flow to bypass multi-factor authentication. By tricking users into entering attacker-generated codes, the service gained persistent OAuth tokens for Microsoft 365 accounts.
According to SpyCloud, the campaign compromised 8,708 accounts across 6,585 domains in 79 countries. Following the platform's emergence, Huntress telemetry recorded a 1,380% increase in device-code phishing attacks.
EvilTokens offered subscriptions ranging from $600 to $1,500. The service provided AI-generated phishing lures and automated tools for business email compromise, allowing attackers to mimic communication styles to solicit funds or sensitive data.
