[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJAteaUQB7Sl_cjaEyP6qyop3mCeZ5rpAuHh-X6YxAQU":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"46001668-4e40-4f52-98d0-3fb8480bf015","Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises","microsoft-takes-down-eviltokens-device-code-phishing-service-tied-to-12-000-inbo-ac1280","Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) \"at every step of the attack chain.\" The action, carried out with authorization from the U.S. District Court for the Eastern District of Virginia, involved the efforts of Health-ISAC, alongside Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver","Microsoft has taken down the EvilTokens device code phishing service, which leveraged AI throughout its attack chain to compromise over 12,000 inboxes. The service, described as a powerful cybercrime platform, used an AI chatbot to analyze victim inboxes, identify trusted relationships, and recommend fraud strategies, including drafting impersonation messages. The operation involved law enforcement and several cybersecurity organizations, leading to arrests in the UK.","Microsoft dismantles EvilTokens phishing service, impacting 12,000 inboxes.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fmicrosoft-takes-down-eviltokens-device.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjyLwFD0zZ8OEPo1dkZ0Tz87aOYoCklNQODjV4MMj90RNo6hRh9rGuJmFQBx5igj0gT1CabBEkSERWh7w_VdfZWpfs6BaJmEMc0KN9nIJXtxpYUINf1alSW9K2whcD9MXF4CaCWAKLJRJQlI51aqGtdpbpbdiX7WjpjTUxDvNgb0gc4qtmuZLat8-lGSFhu\u002Fs1600\u002Fms-eviltokens.jpg","2026-09-22T17:03:31+00:00","2026-09-22T18:00:07.936654+00:00",9,[17,20,23,26,29,31],{"name":18,"type":19},"OAuth 2.0 device authorization flow","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"Storm-2992","threat_actor",{"name":27,"type":28},"EvilTokens","campaign",{"name":30,"type":22},"Cloudflare",{"name":32,"type":22},"OpenAI","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":33,"icon":35,"name":36,"slug":37},[52],{"type":53,"value":54,"context":55},"url","https:\u002F\u002Ft.me\u002F+wNBoU1Gl2mRiYmU0","Telegram group linked to EvilTokens",[21,30,32],{"controls":58,"vendors":138},[59,87,113],{"slug":60,"name":61,"problem":62,"products":63},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[64,72,79],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":73,"vendor_name":21,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":88,"name":89,"problem":90,"products":91},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[92,97,105],{"vendor_slug":73,"vendor_name":21,"vendor_logo":74,"product_slug":93,"product_name":94,"url":95,"description":96},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":114,"name":115,"problem":116,"products":117},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[118,125,130],{"vendor_slug":119,"vendor_name":30,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":73,"vendor_name":21,"vendor_logo":74,"product_slug":126,"product_name":127,"url":128,"description":129},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[139],{"slug":73,"name":21,"logo_path":74,"roles":140},[141],"reported_by",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":160},"ai-powered-device-code-phishing-compromises-12000-inboxes","AI-Powered Device-Code Phishing Compromises 12,000 Inboxes","The EvilTokens service exploited the OAuth device-code authentication flow — a legitimate mechanism designed for input-limited devices — to trick users into granting persistent access tokens to attackers without ever capturing a password. Once tokens were harvested, an embedded AI chatbot autonomously analyzed victim inboxes, mapped trusted relationships, and generated highly convincing impersonation messages to propagate fraud further. This attack demonstrates that modern phishing has evolved beyond credential theft into AI-assisted, token-based account takeover that bypasses MFA entirely. The scale of 12,000 compromised inboxes underscores how quickly automated, platform-as-a-service cybercrime tools can amplify a single attacker's reach. Organizations that rely solely on password-based or traditional MFA defenses are increasingly exposed to token-hijacking techniques.",[147,148,149,150,151,152,153,154,155,156,157,158,159],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-63B: Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST IR-4: Incident Handling","NIST SI-10: Information Input Validation","MITRE ATT&CK T1528: Steal Application Access Token","MITRE ATT&CK T1566: Phishing","OAuth 2.0 RFC 8628: Device Authorization Grant (risk awareness)","GDPR Article 32: Security of Processing (obligation to prevent unauthorized access to personal data)",{}]