EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
Microsoft's Digital Crimes Unit has disrupted EvilTokens, a phishing-as-a-service platform that compromised more than 12,000 Microsoft accounts across over 10,000 organizations. The operation targeted the infrastructure enabling attackers to steal authentication tokens and bypass standard login protections.
Why this matters: Phishing-as-a-service platforms are why credential theft has become so routine. EvilTokens did not just help one attacker. It sold the capability to many, spreading the damage across thousands of organizations at once. Token theft is particularly hard to catch because it sidesteps passwords entirely. If your organization runs on Microsoft accounts, a takedown like this matters, but so does the fact that a single criminal platform got this far before anyone stopped it.
Who should care: Cybersecurity · Privacy officers · Administrators
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.