Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud

EvilTokens, a phishing-as-a-service platform, compromised over 12,000 Microsoft customer email accounts across 10,000+ organizations by stealing session tokens for business email compromise and financial fraud. The platform used AI-driven phishing to enable attackers to conduct unauthorized wire transfers and financial crimes, resulting in $1.7M in confirmed fraud losses. Two operators were arrested in the UK, but the threat actors behind compromised accounts remain active.