Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises

Microsoft shut down EvilTokens, a phishing-as-a-service (PhaaS, a platform that sells phishing tools as a service) platform that used AI at every stage of attacks to compromise email accounts and commit fraud. The service exploited OAuth 2.0 device authorization (a legitimate login method that EvilTokens abused to trick users into granting attackers access to their accounts) to steal account tokens, then used an AI chatbot to analyze victims' inboxes, identify trusted contacts, and recommend fraud strategies. The takedown involved multiple organizations and law enforcement, resulting in the arrest of two men in connection with the operation.