{"data":{"id":"a92f35a6-2be3-4d36-914d-5511871a928c","title":"Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises","summary":"Microsoft announced the takedown of EvilTokens, a phishing-as-a-service platform that abused the OAuth 2.0 device authorization flow to gain authenticated sessions with victim accounts without credentials. The operation used an AI-style chatbot to analyze victims' inboxes, identify trusted relationships and fraud opportunities, and draft impersonation messages. Two men were arrested by the Metropolitan Police Service on September 11, 2026, in connection with the service.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.html","publishedAt":"2026-09-22T17:03:31.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Microsoft","OpenAI"],"affectedVendorsRaw":["Microsoft","OpenAI","EvilTokens"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-22T17:03:31.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}