EvilTokens charged 500/month. The platform was the first to support device code authentication at scale with AI-powered inbox analysis. UK Metropolitan Police Service arrested two men.
Microsoft obtained legal authority to seize active infrastructure; however, this was not a full takedown and the threat remains active though attacks should decrease in volume.