EvilTokens emerged in February 2026 as a widely used phishing-as-a-service platform with AI capabilities for tailoring lures and analyzing compromised inboxes. The platform compromised more than 12,000 inboxes across over 10,000 organizations via device code authentication abuse.
Microsoft tracks the threat actor as Storm-2992. Partners in disruption included Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, Shadowserver, and TRM Labs. This is DCU’s first action against an end-to-end AI-enabled cybercrime service.