Microsoft Revealing EvilTokens (Phishing-as-a-Service)

Microsoft's security blog he describes the fight against a new “cybercrime platform that uses artificial intelligence” (AI) to offer phishing-as-a-service, with analyses of compromised email accounts (to identify high-value targets).

The platform compromised more than 12.000 mailboxes across over 10.000 organizations worldwide, compromising business accounts on a large scale through automated attacks and ready-made phishing templates. Artificial intelligence tools could scan a victim’s inbox to help create more effective phishing messages.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

To dismantle EvilTokens, Microsoft partnered with several organizations — including Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, Shadowserver Foundation, TRM Labs, and Health-ISAC (a non-profit organization that helps healthcare organizations share information about cyberthreats).

From Microsoft's security blog:

Microsoft also notified affected customers, assisted in restoring compromised accounts, and shared information to support further defense and investigative efforts… Microsoft worked closely with specialist officers from the Metropolitan Police Service’s cybercrime team, sharing information that enabled authorities to conduct operations in the United Kingdom. On September 11, 2026, officers arrested two men, aged 32 and 38, and seized digital devices and other items for examination.

Although EvilTokens used artificial intelligence to identify targets and prioritize fraud opportunities, Microsoft researchers used reverse engineering techniques and artificial intelligence tools to analyze the evidence, accelerate the investigation, and identify the infrastructure that supported the service.

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.