Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises

Summary

Microsoft announced the takedown of EvilTokens, a phishing-as-a-service platform that abused the OAuth 2.0 device authorization flow to gain authenticated sessions with victim accounts without credentials. The operation used an AI-style chatbot to analyze victims' inboxes, identify trusted relationships and fraud opportunities, and draft impersonation messages. Two men were arrested by the Metropolitan Police Service on September 11, 2026, in connection with the service.

Related items

• InfoJim Cramer has three lingering questions about Anthropic ahead of its historic IPOSame vendor · CNBC Technology
• MediumGHSA-68g8-gh8f-7rhg: pgEdge RAG Server discloses part of the configured provider credential through API error messagesSame vendor · GitHub Advisory Database
• InfoHow Amplitude ships product improvements in 1–2 days with OpenAISame vendor · OpenAI Blog
• InfoEndor Labs + OpenAI: Strengthening the Defense Factory With Accelerated Remediation | Endor LabsSame vendor · Endor Labs Blog
• InfoJensen Huang built an AI kingdom. Now he’s gone, will Nvidia’s ramparts be breached?Same vendor · The Guardian Technology