Latest
●Prompt injection turns up in website HTTP headers, study finds●Nezha dashboard can be crashed by any low-privilege member●MCP Python SDK kept sessions forever, letting memory run out●Nginx UI flaws let MCP tools skip config security checks●Bank of America adds 1,000 contractors to fix Mythos-found bugs●UK stops short of AI rules in Cyber Security Bill●GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos●Attackers target critical Langflow flaw in 1,423 exploit attempts
Friday, 16 October 2026
1 agent hack today▼ 7 vs yesterday (8)
The Agentic TimesPowered byVortal

Incident database

Microsoft and UK police dismantle EvilTokens AI-powered phishing kit

A coalition led by Microsoft and UK police disrupted the EvilTokens phishing-as-a-service kit, which used an AI chatbot to help criminals analyze compromised inboxes, bypass Microsoft 365 MFA, and identify fraud targets; the operation had compromised roughly 12,000 email accounts across more than 10,000 organizations worldwide before Microsoft seized over 50 websites and UK police arrested two suspected administrators.

Disclosed 22 September 2026 · Record updated 1 October 2026

Impact

Roughly 12,000 email inboxes across more than 10,000 organizations worldwide were compromised via an AI-enabled phishing kit that bypassed MFA and used device-code phishing to silently authenticate as victims.

Our coverage

Sources

  1. theregister.comhttps://theregister.com/security/2026/09/22/uk-cops-arrest-2-eviltokens-suspects-microsoft-seizes-50-phishing-kit-websites/5298317
  2. therecord.mediahttps://therecord.media/two-arrested-in-uk-after-microsoft-takedown-eviltokens