Executive Summary
Microsoft took down EvilTokens, an AI-driven device-code phishing service tied to 12,000 inbox compromises, with Health-ISAC, OpenAI, Cloudflare and others.
What Happened
Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) "at every step of the attack chain." The action, carried out with authorization from the U.S. District Court for the Eastern District of Virginia, involved the efforts of Health-ISAC, alongside Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver
Affected Products
- Microsoft 365
Vulnerability / Attack Technique
AI-driven device code phishing
Technical Mechanism
AI used throughout the phishing chain.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
RealGround Analysis
AI-run phishing services operate at scale.
Recommended Controls
- Block device code flow where not needed
Related RealGround Service
AI CISO Advisory · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.