Microsoft and Met Police shut down EvilTokens phishing service

Microsoft said on 22 September 2026 that it had disrupted EvilTokens, a phishing-as-a-service kit that sold access to compromised Microsoft 365 accounts and used an AI chatbot to help criminals exploit them. According to The Register, the service had been used to compromise 12,000 email inboxes across more than 10,000 organisations worldwide since it emerged in February. Microsoft seized 50 websites used to run the service and disabled more than 150 further domains tied to its supporting infrastructure.

London's Metropolitan Police Service arrested two men, aged 32 and 38, on 18 September. The Register reports that they allegedly acted as administrators of the EvilTokens website, and that both have been released on bail while the investigation continues.

EvilTokens was a device-code phishing kit, meaning it abused the sign-in flow used by devices without keyboards to trick victims into approving an attacker's session. That let buyers bypass multi-factor authentication and silently authenticate as the victim to their organisation's Microsoft 365 applications. The Record reports the service was sold on Telegram for a $1,500 initiation fee plus a recurring $500 monthly subscription.

The AI component is what set it apart, according to The Register. EvilTokens included a chatbot that could analyse a victim's inbox and help criminals decide who to target, which trusted contacts to impersonate, and which fraud strategies would produce the biggest payout. Microsoft VP of security research Tanmay Ganacharya told The Register in an earlier interview that the company had observed 10 to 15 distinct campaigns launching every 24 hours since 15 March 2026.

The takedown followed authorisations from the US District Court for the Eastern District of Virginia. Health-ISAC, a nonprofit that helps health sector organisations share threat information, joined the legal action as a co-plaintiff because healthcare organisations were among those targeted. Microsoft and Health-ISAC worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs to dismantle the platform. Microsoft said it notified affected customers and helped them remediate compromised accounts.

Detective Inspector Serena D'Adamo, whose team led the Met's investigation, said in an emailed statement to The Register: "Phishing services bring misery to thousands, taking money from everyday people across the world." She added that the force "remains committed to holding people to account who facilitate criminal enabling functions and think they can remain undetected".

The operation is the 40th court-authorised disruption carried out by Microsoft's Digital Crimes Unit over nearly two decades, and the first aimed at what the unit describes as an end-to-end AI-enabled cybercrime service. Steven Masada, associate general counsel and general manager of the DCU, wrote in a blog post shared with The Register that the infrastructure had been disrupted but "the model it demonstrated will not disappear with it".

Masada said the practical lesson for defenders is a change in tempo. "Assume that once an inbox is compromised, criminals may understand its contents in minutes, not days," he wrote. He said strong identity protections and monitoring remain essential, but organisations should also independently verify requests to change payment information, redirect funds or approve unusual transactions through a trusted second channel.

That advice reflects the core of the case. The underlying intrusion technique was familiar, but the automated triage of stolen mailboxes compressed the window between a successful phish and a targeted fraud attempt.