[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"focus:microsoft-and-partners-disrupt-eviltokens-a-comprehensive-cybercrime-service-for-muf4ouaa":3},{"item":4},{"id":5,"title":6,"slug":7,"summary":8,"severity":9,"category":10,"cve_ids":11,"affected_products":12,"action_required":16,"article_ids":17,"ioc_summary":19,"source_urls":20,"status":22,"expires_at":23,"created_at":24,"updated_at":25,"articles":26},"2608fc40-e705-483a-8675-4cc0341e68a8","Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud","microsoft-and-partners-disrupt-eviltokens-a-comprehensive-cybercrime-service-for-muf4ouaa","EvilTokens, a phishing-as-a-service platform, compromised over 12,000 Microsoft customer email accounts across 10,000+ organizations by stealing session tokens for business email compromise and financial fraud. The platform used AI-driven phishing to enable attackers to conduct unauthorized wire transfers and financial crimes, resulting in $1.7M in confirmed fraud losses. Two operators were arrested in the UK, but the threat actors behind compromised accounts remain active.","critical","advisory",[],[13,14,15],"Microsoft","EvilTokens","Coinbase","Hunt for anomalous authentication patterns: review Azure AD sign-in logs for impossible travel, unusual locations, off-hours access, and token usage from unfamiliar IPs. Cross-reference with email forwarding rules, inbox rules, and mailbox delegation changes. Prioritize accounts in finance, HR, and executive roles.",[18],"5f79e055-9b9a-4018-b2b8-75350240a960",null,[21],"https:\u002F\u002Fcyberscoop.com\u002Fmicrosoft-eviltokens-cybercrime-service-takedown\u002F","active","2026-09-26T06:05:44.889+00:00","2026-09-24T06:05:50.565023+00:00","2026-09-24T06:06:25.850499+00:00",[27],{"id":18,"title":6,"url":21}]