Microsoft Takes Down EvilTokens, an AI-Assisted Phishing Kit That Hit 12,000 Accounts

Microsoft has disrupted EvilTokens, an underground platform that packaged phishing infrastructure, stolen-session harvesting and AI-written lures into a single service, after linking it to the compromise of roughly 12,000 accounts. The company announced the action against the operation, which security researchers describe as a turnkey kit that let low-skill criminals run campaigns that once required a capable developer. The figure covers victim accounts tied to the platform, not the number of customers who bought access to it.

EvilTokens worked as what threat analysts call phishing-as-a-service. Buyers got ready-made login pages that mimicked Microsoft and other identity providers, a pipeline for capturing session cookies so they could skip past passwords and multi-factor prompts, and tooling that generated convincing messages at scale. That combination is the part that worries defenders: it removes the coding and social-engineering work that used to limit how many people a single operator could target.

The AI component matters because it attacks the weakest link in any phishing chain, which is writing copy that reads naturally. Large language models can produce grammatically clean, contextually plausible email in dozens of languages in seconds, and they can be tuned to a target's industry or job title. That collapses one of the few remaining signals — awkward phrasing, wrong idiom, template errors — that trained employees and mail filters have relied on to spot fraud.

Token theft is the other half of the story. Attackers who capture a valid session cookie can often log in without triggering a fresh authentication challenge, which is why identity vendors have pushed phishing-resistant methods such as passkeys and hardware security keys. EvilTokens appears built specifically to exploit organizations that still lean on password-plus-push-notification MFA. Microsoft has not said whether it is pursuing the operators behind the platform, only that the infrastructure it used has been taken offline.

The takedown is one node in a broader pattern. Microsoft has spent the past two years dismantling criminal infrastructure, including the Storm-1152 group that sold Outlook and Hotmail accounts and the Star Blizzard and Volt Typhoon operations tied to nation-state activity. Each disruption forces crews to rebuild, but the underlying demand for cheap account access does not go away, and kits tend to resurface under new names within months.

What to watch next is whether Microsoft names and charges the people running EvilTokens, and whether the 12,000 affected accounts were concentrated in a few organizations or spread thin. For defenders, the practical question is whether their identity stack still accepts stolen session tokens at all. If it does, the takedown buys time rather than solving the problem.