MICROSOFT DISRUPTS EVILTOKEN PHISHING SERVICE

EvilTokens operated as a criminal service offering phishing infrastructure and token theft capabilities to threat actors. The platform enabled attackers to harvest authentication credentials at scale, providing unauthorized access to corporate and personal Microsoft accounts. Microsoft's DCU coordinated the disruption effort, taking down the service's infrastructure and blocking related malicious activities. The action marks a significant enforcement operation against a major credential theft operation. Accounts compromised through EvilTokens included enterprise email, cloud services, and collaboration platforms. Organizations affected have been notified and advised to review account access logs and implement additional authentication safeguards. The disruption demonstrates ongoing efforts by Microsoft and law enforcement to target phishing-as-a-service platforms that facilitate large-scale account compromise operations. Security researchers estimate such services have cost organizations millions in remediation and incident response costs.