EvilTokens abused Cloudflare Workers and domains to facilitate device code phishing against Microsoft 365 environments. On September 15, 2026, Cloudflare executed a technical takedown of Workers projects supporting the kit, coordinated with Microsoft’s civil legal process to seize associated domains.