This page may contain stale information. Last updated: 2026-09-23
Overview
EvilTokens was a subscription-based phishing-as-a-service (PhaaS) platform (500/month) launched February 2026 via Telegram. Microsoft tracks the operator as Storm-2992. Central feature: AI chatbot analyzing compromised inboxes to identify BEC targets and draft impersonation emails.
Attack Chain
- Device code OAuth phishing — automated spam lures victims to hidden scripts generating attacker-controlled device enrollment codes (Microsoft Entra)
- Inbox analysis — AI processes up to 5,000 emails per batch; maps org charts, payment authorizations
- BEC automation — drafts wire-transfer fraud messages impersonating trusted contacts
Impact & Disruption (Sep 22, 2026)
- 12,000+ compromised Microsoft inboxes across 10,000+ organizations
- Top victim countries: US, Canada, UK, Australia, India, France
- Sectors: wholesale, construction, financial services, real estate, education, healthcare
- Microsoft DCU seized 50 websites + 150+ domains; UK Metropolitan Police arrested two suspects
- Partners: Cloudflare, SpyCloud (8,700+ victim records), OpenAI, Coinbase, Railway, Shadowserver, TRM Labs
Disruption curtailed infrastructure but was not a full takedown — commodity PhaaS using device code phishing persists.
Related
- microsoft
- device-code-phishing
- agentic-threat-actors
- spear-phishing
- business-email-compromise
- ai-agent-security