Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises

Microsoft dismantled EvilTokens, an AI-powered device-code phishing service that compromised over 12,000 mailboxes by using chatbots to analyze inboxes and craft targeted impersonation attacks. Threat actors leveraged AI to identify trusted relationships within victim organizations and automate social engineering at scale. This represents a significant shift in phishing sophistication and inbox compromise methodology.