Microsoft disrupts AI-assisted platform that compromised 12,000

Live updates

1. 6d ago

   Microsoft 365 Targeted by Token-Replay Attacks and EvilTokens

   Microsoft disrupted the EvilTokens platform, which utilized artificial intelligence to compromise 12,000 accounts across 10,000 organizations by exploiting OAuth device authentication. In a separate campaign observed between July 14 and September 22, 2026, cybersecurity researchers detected Microsoft 365 token-replay attacks involving adversary-in-the-middle relays. Huntress researchers reported 497 successful sign-in events from over 200,000 login attempts, resulting in 97 compromised accounts and 48 registered rogue Entra devices across 79 organizations. Meanwhile, separate credential-theft activity involving fake ChatGPT and Claude downloads targeted corporate firms.

   Why it matters

   Modern enterprise environments face escalating threats from automated and AI-driven credential theft campaigns that bypass traditional password security. Adversaries increasingly rely on techniques like token replay and adversary-in-the-middle relays to target cloud productivity suites such as Microsoft 365. Security vendors stress that these sophisticated attack vectors require advanced preventative measures beyond standard detection and response frameworks.

   What is confirmed

   • Microsoft disrupted the EvilTokens platform, which utilized artificial intelligence to compromise 12,000 accounts across 10,000 organizations globally by exploiting OAuth device authentication processes.
   • Huntress observed a Microsoft 365 campaign using adversary-in-the-middle relays between July 14 and September 22, 2026.
   • Huntress researchers Andrea Hatcher, Susannah Matt, Matt Poto, and Andrew Schwartz reported that attackers replayed stolen sign-in tokens to break into email accounts at 79 organizations.
   • Researchers detected 497 successful Microsoft 365 sign-in events from over 200,000 login attempts originating from the 193.26.115[.]0/24 IP range, resulting in 97 compromised accounts and 48 rogue Entra devices.

   Still unconfirmed

   • ANY.RUN analyzed 1,258 sandbox submissions showing how fake ChatGPT and Claude downloads and setup guides steal corporate credentials and browser session data.

   What to watch next

   • Additional disclosures from cybersecurity firms regarding the scale of the token-replay attacks.
   • Further technical analysis on how artificial intelligence tools are accelerating credential harvesting and OAuth exploitation.
   Sources used for this update (5)

   1. arstechnica.com — Tag: AI - Ars Technica
   2. thehackernews.com — Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at ...
   3. learn.microsoft.com — Account compromised, e-mails getting redirected by ...
   4. prevent-ransomware.com — EvilTokens: When AI Moves Faster Than Cybersecurity
   5. hackread.com — Fake AI Attacks Target US Firms as Researchers Warn of ...
   confidence 95%
2. 11d ago

   Microsoft disrupts EvilTokens AI platform compromising 12,000 accounts

   Microsoft has disrupted EvilTokens, an AI-assisted platform used to compromise 12,000 accounts across 10,000 organizations globally. The platform exploited OAuth device authentication processes to gain unauthorized access. This operation is part of Microsoft's broader effort to target cybercrime suppliers.

   Why it matters

   EvilTokens utilized tools from the Storm-2992 cybercrime group to execute its attacks. This disruption is part of Microsoft's ongoing efforts to combat cybercrime and protect its users' accounts. The compromised accounts were spread across various organizations worldwide.

   What is confirmed

   • Microsoft disrupted EvilTokens, an AI-assisted platform that compromised 12,000 accounts across 10,000 organizations globally.
   • EvilTokens exploited OAuth device authentication processes to gain unauthorized access.
   • Microsoft's Digital Crimes Unit seized 50 sites and disabled 150 domains behind EvilTokens.
   • The EvilTokens platform utilized tools from the Storm-2992 cybercrime group to execute its attacks.

   What to watch next

   • Further details on the Storm-2992 cybercrime group's involvement
   • The impact of the disruption on EvilTokens' operations and users
   • Microsoft's future efforts to target similar cybercrime suppliers
   Sources used for this update (5)

   1. worldwirereport.com — Microsoft Disrupts AI Scam Platform Affecting 12,000 Accounts
   2. www.orcarouter.ai — Microsoft Dismantles EvilTokens and Its AI Inbox Reader
   3. www.microsoft.com — Inside the LiteLLM 1.107.0 supply chain compromise ...
   4. cybersecuritytimes.com — Hackers Register 48 Rogue Entra Devices After Hijacking ...
   5. www.cyberbreaches.org — Cyberattacks in 2026 - Cyber Breaches
   confidence 100%
3. 14d ago

   Microsoft disrupts AI-assisted platform compromising 12,000 accounts

   Microsoft has disrupted EvilTokens, an AI-assisted platform used to compromise 12,000 accounts across 10,000 organizations globally. The platform exploited OAuth device authentication processes to gain unauthorized access. This operation is part of Microsoft's broader effort to target cybercrime suppliers. EvilTokens utilized tools from the Storm-2992 cybercrime group to execute its attacks.

   Why it matters

   This incident highlights the growing threat of AI-assisted cybercrime platforms. Microsoft's disruption of EvilTokens is part of a larger effort to combat cybercrime, including the disruption of cryptocurrency-accepting groups linked to over one billion phishing messages this year. The use of AI in cybercrime is a concerning trend, as it can significantly increase the scale and effectiveness of attacks.

   What is confirmed

   • Microsoft disrupted EvilTokens, a subscription-based platform that used AI to compromise 12,000 accounts across 10,000 organizations globally.
   • EvilTokens exploited OAuth device authentication processes to gain unauthorized access.
   • Microsoft is targeting cybercrime suppliers, including cryptocurrency-accepting groups linked to over one billion phishing messages this year.
   • Threat actor UNK_SneakyStrike used TeamFiltration to launch password-spraying attacks on over 80,000 Microsoft Entra ID accounts.

   What to watch next

   • Further details on the Storm-2992 cybercrime group
   • Impact of Microsoft's disruption of EvilTokens on cybercrime platforms
   • Number of organizations affected by TeamFiltration password-spraying attacks
   Sources used for this update (4)

   1. arstechnica.com — Category: Biz & IT - Ars Technica
   2. dailysecurityreview.com — Password-Spraying Campaign Hits Over 80,000 Microsoft Entra ...
   3. learn.microsoft.com — Outlook account has been compromised - Microsoft Q&A
   4. learn.microsoft.com — account hacked !!!!!!! - Microsoft Q&A
   confidence 90%
4. 17d ago

   Microsoft shuts down EvilTokens AI phishing platform

   Microsoft disrupted EvilTokens, a subscription-based platform that used AI to compromise 12,000 accounts across 10,000 organizations globally. The service exploited OAuth device authentication processes to gain unauthorized access. This operation is part of a broader effort by Microsoft to target cybercrime suppliers, which includes the disruption of cryptocurrency-accepting groups linked to over one billion phishing messages this year. The EvilTokens platform specifically utilized tools from the Storm-2992 cybercrime group to execute its attacks.

   Why it matters

   The attack follows a series of SharePoint zero-day vulnerabilities that impacted U.S. agencies, universities, and businesses. In Switzerland, a related attack led the Federal Office of Information Technology, Systems and Telecommunication to block external internet access after 200 accounts were compromised.

   What is confirmed

   • Microsoft disrupted EvilTokens, an AI-assisted platform that compromised 12,000 accounts across 10,000 organizations.
   • EvilTokens operated as a subscription-based platform exploiting OAuth device authentication processes.
   • The EvilTokens platform used tools developed by the Storm-2992 cybercrime group.

   Still unconfirmed

   • Microsoft disrupted cryptocurrency-accepting cybercrime suppliers linked to more than one billion phishing messages this year.

   What to watch next

   • Confirmation of total accounts recovered from the EvilTokens disruption
   • Identification of other platforms using the Storm-2992 toolset
   Sources used for this update (5)

   1. rocketnews.com — Microsoft disrupts AI-assisted platform that compromised ...
   2. learn.microsoft.com — My account has been hacked, how can i recover it ...
   3. www.kucoin.com — Microsoft Disrupts Phishing Suppliers Targeting 75,000 ...
   4. learn.microsoft.com — Account hacked - Microsoft Q&A
   5. hackernoob.tips — Cybersecurity Tips & Tutorials for Beginners | HackerNoob.tips
   confidence 90%
5. 20d ago

   Microsoft dismantled EvilTokens AI phishing platform

   Microsoft disrupted EvilTokens, an AI-assisted phishing platform that compromised 12,000 accounts across 10,000 organizations. The platform utilized tools developed by the Storm-2992 cybercrime group to execute its attacks. This action follows separate security breaches involving SharePoint zero-day vulnerabilities that affected global businesses, universities, and U.S. agencies. In Switzerland, the Federal Office of Information Technology, Systems and Telecommunication blocked external internet access after a SharePoint-related attack compromised roughly 200 accounts.

   Why it matters

   These incidents highlight a pattern of vulnerabilities within Microsoft software being exploited by sophisticated actors. The use of AI in phishing platforms like EvilTokens increases the scale and efficiency of account compromises.

   What is confirmed

   • Microsoft disrupted the EvilTokens AI phishing platform.
   • EvilTokens compromised 12,000 accounts across 10,000 organizations.
   • The EvilTokens platform relied on tools from the Storm-2992 cybercrime group.
   • A SharePoint zero-day vulnerability was used to breach U.S. agencies, universities, and global businesses.
   • The Swiss Federal Office of Information Technology, Systems and Telecommunication blocked external internet access after approximately 200 accounts were compromised via SharePoint vulnerabilities.

   What to watch next

   • Identification of other groups using Storm-2992 tools
   • Further disclosures on the specific data lost by U.S. agencies during the SharePoint breach
   Sources used for this update (5)

   1. account.microsoft.com — Microsoft account | Sign In or Create Your Account Today ...
   2. apps.microsoft.com — Microsoft Store - Download apps, games & more for your Windows PC
   3. support.microsoft.com — Sign in to Microsoft 365
   4. support.microsoft.com — Contact Microsoft customer support | Microsoft Support
   5. m365.cloud.microsoft — Microsoft 365 - Sign into Copilot
   confidence 100%
6. 23d ago

   Microsoft SharePoint Zero-Day and Swiss IT Office Hit

   Hackers exploited a zero-day vulnerability in Microsoft SharePoint to breach U.S. agencies, global businesses, and universities, resulting in the loss of critical data prior to patch deployment. Separately, the Swiss Federal Office of Information Technology, Systems and Telecommunication blocked internet access for external users after a cyberattack compromised approximately 200 accounts using SharePoint software vulnerabilities. These incidents follow a prior Microsoft disruption of the EvilTokens AI phishing platform, which compromised 12,000 accounts across 10,000 organizations and relied on tools from the Storm-2992 cybercrime group.

   Why it matters

   Recent attacks target core enterprise collaboration software and identity protections, demonstrating persistent risks to global administrative systems. While previous incidents involved automated artificial intelligence phishing operations to bypass multifactor authentication, the newer intrusions leverage software zero-day flaws to access critical networks. Authorities continue to grapple with the security implications of widespread enterprise technology dependencies.

   What is confirmed

   • Hackers exploited a zero-day vulnerability in Microsoft SharePoint to breach U.S. agencies, global businesses, and universities.
   • The Swiss Federal Office of Information Technology blocked internet access for external users after an attack compromised about 200 accounts.

   Still unconfirmed

   • Attackers against the Swiss Federal Office of Information Technology are believed to have exploited vulnerabilities in Microsoft SharePoint software.

   What to watch next

   • Deployment and adoption rates of Microsoft SharePoint security patches across affected sectors
   • Official disclosures regarding the specific U.S. agencies and global universities impacted by the zero-day exploit
   • Further findings on the connection between the SharePoint zero-day exploits and known threat groups like Storm-2992
   Sources used for this update (3)

   1. swissobserver.com — Swiss Federal IT Office Hit by Cyberattack, Blocks External ...
   2. dailysecurityreview.com — Widespread Cyberattack Exploits Microsoft SharePoint Zero-Day ...
   3. www.yahoo.com — All AI is ‘compromised’ and has fewer rules than milk ...
   confidence 90%
7. 26d ago

   Microsoft Disrupted AI Phishing Platform EvilTokens

   Microsoft and law enforcement disrupted EvilTokens, a subscription-based phishing platform that used artificial intelligence to compromise 12,000 Microsoft accounts across 10,000 organizations worldwide. Launched in February 2026, the service automated email fraud attacks and stole OAuth tokens to bypass multifactor authentication. UK police arrested two men suspected of offenses linked to the operation, while a financially motivated cybercrime actor known as Storm-2992 developed and supported the tool.

   Why it matters

   The malicious platform operated on a subscription model, utilizing an AI chatbot and device-code phishing to automate account takeovers and analyze victim inboxes. Compromised third-party inboxes expose trusted communications and fuel business email compromise fraud. Meanwhile, threat intelligence warns of similar telegram-based phishing services, such as Kali365, which also exploit Microsoft device code authentication.

   What is confirmed

   • Microsoft disrupted EvilTokens, a subscription-based platform that used AI to compromise 12,000 Microsoft accounts across 10,000 organizations worldwide.
   • EvilTokens launched in February 2026 and bypassed multifactor authentication by stealing OAuth tokens instead of passwords.
   • Financially motivated cybercrime actor Storm-2992 developed, sold, updated, and supported the EvilTokens phishing-as-a-service platform.

   Still unconfirmed

   • The FBI warns that a separate Telegram platform named Kali365 exploits Microsoft device code authentication to bypass MFA entirely and capture persistent OAuth tokens.

   What to watch next

   • Further law enforcement arrests or charges against additional members of the Storm-2992 cybercrime group.
   • Additional Microsoft security disclosures regarding related Telegram-based phishing services like Kali365.
   Sources used for this update (11)

   1. dailysecurityreview.com — FBI Warns Kali365 PhaaS Platform Bypasses Microsoft 365 MFA
   2. arstechnica.com — Category: Security - Ars Technica
   3. rocketnews.com — Microsoft disrupts AI-assisted platform that compromised ...
   4. rocketnews.com — Microsoft disrupts AI-assisted platform that compromised ...
   5. dailysecurityreview.com — EvilTokens Service Breaches 340 Microsoft 365 Orgs via OAuth ...
   6. mallory.ai — Storm-2992 - mallory.ai
   7. www.windowscentral.com — Hackers hijacked Microsoft's X account to promote a Clippy ...
   8. www.lawfuel.com — Microsoft’s Copilot AI Read Your Confidential Emails — And ...
   9. learn.microsoft.com — I think I may have been hacked - Microsoft Q&A
   10. rpost.com — How Compromised Third-Party Inboxes Put Your Business at Risk
   11. learn.microsoft.com — AI agent runtime protection with Microsoft Defender for ...
   confidence 95%
8. 33d ago

   Microsoft disrupts AI-assisted phishing platform EvilTokens

   Microsoft and law enforcement shut down EvilTokens, an AI-powered phishing-as-a-service platform that compromised 12,000 Microsoft accounts across 10,000 organizations. The platform operated via a subscription model, using an AI chatbot and device-code phishing to automate account takeovers and analyze victim inboxes. UK police arrested two men suspected of offenses linked to the service.

   Why it matters

   The takedown of EvilTokens highlights the growing threat of AI-assisted phishing attacks and the importance of collaboration between tech companies and law enforcement to combat cybercrime. Phishing-as-a-service platforms like EvilTokens make it easier for criminals to launch large-scale attacks. Microsoft's disruption of the platform aims to prevent further damage.

   What is confirmed

   • Microsoft accounts of 12,000 users across 10,000 organizations were compromised.
   • EvilTokens operated via a subscription model, charging $1,500 a month.
   • Microsoft and law enforcement seized 50 websites to disrupt the platform's infrastructure.
   • UK police arrested two men suspected of offenses linked to EvilTokens.

   Still unconfirmed

   • The AI chatbot and device-code phishing were used to automate account takeovers and analyze victim inboxes.

   What to watch next

   • Further arrests linked to EvilTokens
   • Microsoft's continued efforts to disrupt similar phishing-as-a-service platforms
   • The impact of the takedown on the broader phishing ecosystem
   Sources used for this update (3)

   1. dailysecurityreview.com — Microsoft Seizes 50 EvilTokens Phishing Sites, UK Arrests 2
   2. quiversphere.com — Microsoft dismantles AI-driven platform linked to 12,000 ...
   3. gokhshtein.com — Microsoft Dismantles $1,500-a-Month Phishing SaaS | Gokhshtein
   confidence 95%
9. 34d ago

   UK Police Arrest Two Suspects in Microsoft EvilTokens Takedown

   Microsoft and industry partners dismantled EvilTokens, an AI-powered phishing-as-a-service platform that compromised 12,000 Microsoft accounts across 10,000 organizations. A court-authorized operation seized 50 websites to strip the network of its infrastructure. UK police arrested two men suspected of offenses linked to the service. The platform operated via a subscription model, using an AI chatbot and device-code phishing to automate account takeovers and analyze victim inboxes. The operation targeted Microsoft 365 accounts through OAuth exploitation techniques.

   Why it matters

   EvilTokens lowered the barrier for cybercrime by allowing users to launch mass hacking campaigns for a monthly subscription fee. This incident coincides with broader trends in AI-driven threats, including the emergence of fully autonomous ransomware.

   What is confirmed

   • The EvilTokens operation compromised 12,000 accounts across 10,000 organizations worldwide.
   • A court-authorized operation seized 50 websites to disrupt the infrastructure.
   • UK police arrested two men suspected of offenses connected to the phishing service.
   • The platform used an AI chatbot to analyze the inboxes of victims.
   • The service utilized device-code phishing and OAuth exploitation to steal sessions and take over Microsoft 365 accounts.

   Still unconfirmed

   • The subscription fee for the EvilTokens platform was 500,000 won per month.
   • The first fully autonomous ransomware attack, JADEPUFFER, hit organizations in July 2026.

   What to watch next

   • Legal proceedings or indictments against the two arrested suspects in the UK.
   • Further disclosures from the Microsoft Digital Defense Report 2026 regarding autonomous AI threats.
   Sources used for this update (13)

   1. arstechnica.com — Dan Goodin
   2. blog.hangadac.com — AI 피싱 이블토큰 1만2천 계정 털린 수법 - 천의무봉
   3. yoda.co.kr — AI 에이전트 보안·상거래·모델 경쟁 격화 • 요다 한마디
   4. rocketnews.com — Microsoft disrupts AI-assisted platform that compromised ...
   5. investingsage.com — AI Cybersecurity Is Becoming a New Cost of the AI Boom
   6. techjournal.org — Microsoft Disrupts EvilTokens AI Phishing Service
   7. www.aiaffairs.com — Microsoft disrupts EvilTokens platform linked to more than ...
   8. www.escudodigital.com — Microsoft disrupts EvilTokens device code phishing operation
   9. www.techtimes.com — Microsoft 2026 Security Report: Autonomous Ransomware Has Hacked Real Organizations
   10. rocketnews.com — Microsoft disrupts AI-assisted platform that compromised ...
   11. rocketnews.com — Microsoft disrupts AI-assisted platform that compromised ...
   12. techhelp.ca — Microsoft Disrupts EvilTokens AI Phishing Service
   confidence 95%
10. 40d ago

    Microsoft Disrupted EvilTokens Phishing Platform Linked to 12000 Hacks

    Microsoft and industry partners disrupted the EvilTokens cybercrime operation, a subscription-based phishing-as-a-service platform that compromised 12,000 email inboxes across more than 10,000 organizations worldwide. Operating since February 2026 and marketed through a Telegram channel, EvilTokens utilized device code phishing and an integrated AI chatbot to automate account compromise, target identification, and email analysis. The coordinated takedown stripped the malicious network of its infrastructure by seizing 50 websites.

    Why it matters

    The operation demonstrates how cybercriminals increasingly integrate artificial intelligence into off-the-shelf tooling to scale attacks and accelerate financial fraud. EvilTokens provided an end-to-end service that lowered the technical barrier for mass compromises by handling everything from initial token theft to post-breach inbox mining. Microsoft executed the disruption through its Digital Crimes Unit alongside industry partners.

    What is confirmed

    • Microsoft disrupted EvilTokens, a subscription-based phishing-as-a-service platform linked to 12,000 compromised email inboxes across more than 10,000 organizations.
    • EvilTokens emerged in February 2026 and used device code phishing combined with an AI chatbot to analyze victim inboxes and prepare payment fraud.
    • The Microsoft Digital Crimes Unit facilitated the disruption of the network and seized 50 websites.

    What to watch next

    • Further arrests or legal action against the operators behind EvilTokens
    • Additional details on the specific threat intelligence partners that aided the Microsoft Digital Crimes Unit
    Sources used for this update (11)

    1. www.techflowpost.com — TechFlow Intel: OpenAI halts training for its most advanced model, ASML projects "zero sales" in Europe for 2026
    2. arstechnica.com — Microsoft disrupts AI-assisted platform that compromised 12,000 accounts
    3. www.microsoft.com — Unmasking EvilTokens: Getting to the root of device code phishing | Microsoft Security Blog
    4. flipboard.com — India’s education system is failing in new ways
    5. www.techspot.com — Microsoft takes down EvilTokens phishing service that used AI to mine hacked inboxes for payment fraud
    6. daily.dev — Microsoft disrupts AI-assisted platform that compromised...
    7. arstechnica.com — Microsoft disrupts AI-assisted platform that compromised 12,000
    8. www.newsmobile.in — Microsoft Takes Down Platform Used In 12,000 Account Hacks
    9. emergent.sh — Microsoft Disrupts AI Platform Behind 12,000 Account Hack
    10. thejournal.com — AI Platform Behind 12,000 E-mail Breaches Dismantled
    11. rocketnews.com — Microsoft disrupts AI-assisted platform that compromised ...
    confidence 100%
11. 45d ago

    Microsoft Disrups EvilTokens Phishing Service

    Microsoft and Coinbase disrupted the EvilTokens cybercrime operation, a platform tied to 12,000 inbox compromises. The takedown of the AI-assisted service involved an investigation that led to arrests of the operators behind the DIY phishing network. EvilTokens utilized device code phishing techniques to compromise user accounts, highlighting the growing threat of artificial intelligence in cybercrime infrastructure. The action stripped the malicious platform of access to its essential infrastructure.

    Why it matters

    Device code phishing attacks target authentication flows by tricking users into authorizing malicious devices. The disruption of EvilTokens offers a window into how threat actors leverage artificial intelligence tools to scale attacks. Security researchers continue to analyze the operation to understand the full extent of AI integration in modern cybercrime.

    What is confirmed

    • Microsoft disrupted the EvilTokens platform, which was tied to 12,000 inbox compromises.
    • A joint probe by Microsoft and Coinbase led to the arrest of the individuals behind EvilTokens.
    • EvilTokens operated as an AI-assisted, DIY phishing network.
    • The service utilized device code phishing.

    What to watch next

    • Further details on the identities of the arrested suspects
    • Additional law enforcement actions against related AI-powered phishing networks
    Sources used for this update (7)

    1. Ars Technica — Microsoft disrupts AI-assisted platform that compromised 12,000
    2. Microsoft — Unmasking EvilTokens: Getting to the root of device code phishing
    3. csoonline.com — Microsoft’s EvilTokens takedown sheds light on state of AI-powered cybercrime
    4. Coinbase — Consumer Protection Tuesday: Taking Down Evil Tokens
    5. The Hacker News — Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
    6. Fortune — Microsoft and Coinbase probe leads to arrest of crooks behind 'EvilTokens', a DIY phishing network powered by AI
    7. Axios — A major AI-powered phishing service has lost access to its key infrastructure
    confidence 95%