EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts

Microsoft, in coordination with the Health-ISAC, law enforcement, and SpyCloud, disrupted the EvilTokens phishing-as-a-service (PhaaS) platform, which had compromised over 12,000 Microsoft accounts across 10,000 organizations. The threat actor, tracked as Storm-2992, offered AI-powered device-code phishing capabilities that bypassed MFA by abusing Microsoft's OAuth 2.0 device-authorization flow. The service enabled affiliates to conduct business email compromise (BEC) campaigns by harvesting credentials through phishing lures impersonating legitimate services and using AI to identify high-value targets within compromised inboxes.

AI-extracted · verify before operational use