Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud

EvilTokens exploited a fundamental weakness in session-based authentication: once a valid session token is stolen, multi-factor authentication is effectively bypassed, granting attackers persistent access without needing credentials. The platform's use of AI to craft convincing phishing emails lowered the detection barrier for even security-conscious users, demonstrating that human awareness alone is insufficient against adaptive, automated attacks. The scale of compromise — spanning 10,000+ organizations — highlights how phishing-as-a-service platforms commoditize sophisticated attack techniques, making them accessible to low-skill threat actors. This matters because business email compromise remains one of the highest-ROI attack vectors for financial fraud, and session token theft is an increasingly preferred method to sidestep modern MFA controls.