SpyCloud supported disruption of EvilTokens by contributing recaptured data from over 8,700 unique EvilTokens victims. 97.5% of compromised accounts were enterprise accounts. EvilTokens uses LLMs to analyze compromised inboxes for business email compromise (BEC) attacks.
EvilTokens commoditized device code phishing at scale. Multiple other commodity PhaaS platforms continue using similar tactics.