Microsoft and the Met dismantle EvilTokens, an AI phishing kit for hire
The Telegram-sold service charged $1,500 (£1,100) to join and $500 (£370) a month, sidestepped multifactor authentication on Microsoft 365 and used a chatbot to read stolen inboxes for payment fraud
- EvilTokens launched in February 2026 and was sold on Telegram for a $1,500 (£1,100) joining fee plus $500 (£370) a month.
- Microsoft links the service to more than 12,000 compromised inboxes across over 10,000 organizations worldwide.
- Met officers arrested two men, aged 32 and 38, and released them on police bail.
- Microsoft seized 50 websites and disabled more than 150 domains under a US court order on 22 September.
- The action is the Digital Crimes Unit’s 40th court-authorized disruption.
Multifactor authentication alone will not stop this kind of attack, so Microsoft 365 administrators should review which sign-in flows let a user authorize a session by entering a code and restrict them with conditional access where they are not needed. Alert on new sessions and mailbox access from unfamiliar locations. Finance teams should confirm any change to payment details on a second, known channel, and staff should learn that a genuine Microsoft page can still be part of a scam.
“The infrastructure supporting EvilTokens has been disrupted, but the model it demonstrated will not disappear with it.”Steven Masada, associate general counsel and general manager, Digital Crimes Unit, Microsoft
Microsoft’s Digital Crimes Unit (DCU) and the Metropolitan Police have shut down EvilTokens, a phishing-as-a-service platform that Microsoft links to more than 12,000 compromised email inboxes at over 10,000 organizations since it launched in February 2026. On 22 September Microsoft said it had seized 50 websites and disabled more than 150 domains under an order from the US District Court for the Eastern District of Virginia. Met officers had already arrested two men, aged 32 and 38, on suspicion of running the service: The Register dates the arrests to 18 September, Microsoft’s blog to 11 September.
The kit did not steal passwords. It tricked victims into entering an authentication code on Microsoft’s genuine sign-in page, giving the attacker persistent access without tripping multifactor authentication (MFA). A chatbot then read the captured mailbox and mapped who approved payments, who moved money and which threads discussed wire transfers, so a buyer could pick a target for invoice fraud in minutes. Microsoft says the largest victim counts were in the US, Canada, the UK, Australia, India and France, in sectors from wholesale distribution and construction to financial services and healthcare.
Two named defendants and a 40th takedown
The civil complaint, filed on 22 September alongside the healthcare threat-sharing body Health-ISAC, names Felix Utomi, Waidi Segun Adams and five unnamed defendants. Seven organizations, among them Cloudflare, OpenAI and Coinbase, supported the action, which Microsoft counts as the DCU’s 40th court-authorized disruption and its first against a service that used AI from intrusion to fraud. The Register reported on 22 September that the two men, alleged to have administered the EvilTokens website, had been released on bail.
Sources
- Microsoft On the Issues, “Disrupting EvilTokens: the AI chatbot built for cybercrime”, Steven Masada, 22 September 2026. https://blogs.microsoft.com/on-the-issues/2026/09/22/disrupting-eviltokens-the-ai-chatbot-built-for-cybercrime/
- The Register, “UK cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites”, Jessica Lyons, 22 September 2026. https://www.theregister.com/security/2026/09/22/uk-cops-arrest-2-eviltokens-suspects-microsoft-seizes-50-phishing-kit-websites/5298317
- Microsoft Digital Crimes Unit, notice of pleadings, Microsoft Corporation v. Felix Utomi et al, Civil Action No. 1:26-cv-3047, US District Court for the Eastern District of Virginia, filed 22 September 2026. https://www.microsoft.com/en-us/corporate-responsibility/customer-security-trust/digital-crimes-unit/notice-of-pleadings/eviltokens/
- Microsoft Security Blog, “Unmasking EvilTokens: Getting to the root of device code phishing”, Microsoft Threat Intelligence, 22 September 2026. https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/
