[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJOVugI7wAy3_ekepLoVZdEK5PiYabnFbrx3jMZFhaO0":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"c0702817-dc10-482e-9af6-b67fc14e15a3","Microsoft Disrupts AI-Powered EvilTokens Service Linked to 12,000 Hacked Inboxes","microsoft-disrupts-ai-powered-eviltokens-service-linked-to-12-000-hacked-inboxes-47a9ef","Microsoft disrupted EvilTokens after the AI-powered phishing service compromised 12,000 inboxes across 10,000 organisations and enabled complex financial fraud.","Microsoft has taken down EvilTokens, an AI-powered phishing-as-a-service platform that compromised over 12,000 email inboxes across 10,000 organizations. The service used AI to analyze compromised inboxes, identify payment authorization capabilities, and map trusted relationships to facilitate complex financial fraud. The operation involved seizing 50 websites and disabling over 150 domains, with two arrests made in the UK.","Microsoft disrupts AI-powered EvilTokens phishing service, impacting 12,000 inboxes.","https:\u002F\u002Fhackread.com\u002Fmicrosoft-disrupts-ai-powered-eviltokens-service\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Fmicrosoft-disrupts-ai-powered-eviltokens-service-2.png","2026-09-23T14:07:46+00:00","2026-09-23T20:00:50.278756+00:00",9,[17,20,23,26],{"name":18,"type":19},"EvilTokens","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"Storm-2992","threat_actor",{"name":27,"type":28},"AI","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":29,"icon":31,"name":32,"slug":33},null,"Threat Intelligence","threat-intelligence",[35,40,45,50],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":51},{"id":52,"icon":31,"name":53,"slug":54},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[],[21,18],{"controls":58,"vendors":142},[59,87,113],{"slug":60,"name":61,"problem":62,"products":63},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[64,72,79],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":73,"vendor_name":21,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":88,"name":89,"problem":90,"products":91},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[92,100,105],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":73,"vendor_name":21,"vendor_logo":74,"product_slug":101,"product_name":102,"url":103,"description":104},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":114,"name":115,"problem":116,"products":117},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[143],{"slug":73,"name":21,"logo_path":74,"roles":144},[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":166},"ai-powered-phishing-service-hijacks-12000-inboxes-for-financial-fraud","AI-Powered Phishing Service Hijacks 12,000 Inboxes for Financial Fraud","EvilTokens exploited compromised email credentials to gain persistent access to inboxes, then used AI to intelligently map trusted relationships and payment authorization workflows — dramatically amplifying the damage a single compromised account could cause. The root problem is a combination of weak or reused credentials, insufficient multi-factor authentication adoption, and a lack of anomalous login detection. This matters because attackers no longer need to brute-force systems manually; AI-assisted tooling allows them to scale targeted financial fraud at industrial speed. Organizations that do not monitor for unusual inbox access patterns or unexpected email delegation rules are effectively blind to this class of attack.",[151,152,153,154,155,156,157,158,159,160,161,162,163,164,165],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 SI-4 (System Monitoring)","NIST CSF DE.CM-1 (Network Monitoring)","NIST CSF PR.AC-7 (Users, Devices, and Other Assets are Authenticated)","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","MITRE ATT&CK T1114 – Email Collection","MITRE ATT&CK T1078 – Valid Accounts","MITRE ATT&CK T1566 – Phishing",{}]