Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises

Microsoft has taken down the EvilTokens device-code phishing service, which utilized artificial intelligence throughout its attack process. The takedown was authorized by the US District Court for the Eastern District of Virginia and involved collaboration with several organizations. The EvilTokens service was reportedly tied to approximately 12,000 inbox compromises. Microsoft worked with companies including Health-ISAC, Cloudflare, and Coinbase to dismantle the service. The operation also involved input from OpenAI, Railway, SpyCloud, and The Shadowserver. The combined efforts led to the successful disruption of the EvilTokens phishing service.