A phishing operation that compromised more than 12,000 inboxes across 10,000 companies just got taken down in a coordinated raid spanning Microsoft, Coinbase, Cloudflare, OpenAI, and UK police. The service, called EvilTokens, is notable less for its scale and more for the trick at its core: it beat multi-factor authentication using a login flow that was completely genuine.
How EvilTokens Actually Beat MFA
The attack used a technique called device-code phishing. A victim receives a message directing them to a real Microsoft login page and asking them to enter a code. That part is the trap: the code was generated by the attacker, not the victim’s own device. Entering it hands the attacker a persistent OAuth token with full access to the victim’s Microsoft 365 account — and because the authentication itself is completely genuine, MFA provides zero protection. The malicious part was never the login. It was the setup that tricked someone into authenticating on the attacker’s behalf.
Sold as a Subscription, Not Hidden in the Shadows
EvilTokens launched on Telegram in mid-February 2026 for a $1,500 upfront fee plus a $500 monthly subscription — phishing-as-a-service, packaged like ordinary SaaS. AI did the heavy lifting throughout: it tailored lures to specific targets and sifted through compromised inboxes to identify high-value accounts worth prioritizing. Security researchers at Huntress reported device-code phishing attacks grew 1,380% in 2026 compared to the year before, and EvilTokens is widely credited as the platform that took the technique mainstream.
The Takedown Required a Genuine Coalition
Microsoft’s Digital Crimes Unit obtained authorization from the US District Court for the Eastern District of Virginia and coordinated with Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, the Shadowserver Foundation, and TRM Labs. Each partner contributed a different piece: network telemetry, cryptocurrency payment tracing, cloud infrastructure data. Coinbase and TRM Labs traced roughly $1.1 million in revenue through more than 700 addresses on the Tron blockchain. SpyCloud independently confirmed 8,708 compromised accounts across 6,585 domains in 79 countries. The operation seized 50 websites and disabled more than 150 domains, and London’s Metropolitan Police arrested two men, aged 32 and 38, on September 11 in connection with running the service’s technical infrastructure. Both were released on bail while the investigation continues.
How to Actually Protect Yourself
Device-code phishing specifically targets a sign-in flow that’s normally used for smart TVs, printers, and other devices without a keyboard — you almost never need to enter a device code as part of routine account access. Treat any unexpected request to enter one as an immediate red flag, especially if it arrives by email or text rather than something you initiated yourself. If your organization doesn’t rely on device-code sign-in for legitimate purposes, ask your IT team whether it can be disabled entirely at the tenant level, which removes the attack surface outright rather than relying on user vigilance alone.
Bottom Line
This marks the 40th legal seizure carried out by Microsoft’s Digital Crimes Unit in nearly two decades of operation, and the first aimed specifically at a criminal service built around AI rather than merely using it at the margins. That distinction matters: EvilTokens represents a maturing phishing-as-a-service market where AI handles targeting and message generation at a scale human operators couldn’t match alone. The technique it exploited isn’t new, but the packaging and automation are — and with the investigation still open against other suspects, this is unlikely to be the last device-code phishing platform law enforcement has to dismantle.
