Case 10Microsoft 365 / EvilTokens
EvilTokens used stolen Microsoft sessions and AI-assisted mailbox analysis to prepare fraud
Microsoft links EvilTokens to more than 12,000 compromised inboxes. Its AI-assisted fraud tools were used in at least one observed incident; wider use is unknown.
- Affected system
- Microsoft 365 device-code authentication, account sessions and mailboxes
- Case status
- Disrupted; investigation open
- Sources checked
- Evidence
- Incident sources / Oversight
Overview
EvilTokens was a phishing service that induced people to authorize an attacker-controlled device on Microsoft's real sign-in page, granting an attacker-controlled session access to Microsoft 365 accounts. Microsoft says the service was linked to more than 12,000 compromised inboxes at over 10,000 organizations after a February 2026 launch; on September 22 it announced a court-authorized interim disruption and said Metropolitan Police officers had arrested two men in Britain. A federal court granted a preliminary injunction on October 5 after the defendants had not appeared or otherwise responded to the order to show cause. Microsoft describes one observed incident in which an attacker used the service’s AI capability to select high-value targets. The number of victims whose messages underwent AI analysis is unknown. The provisional impact rating is Critical (4/4) under the Board’s widespread-harm criterion, based on Microsoft’s reported compromise across more than 10,000 organizations. No independent audit of that count was identified in this research pass. Record first published September 23, 2026; sources checked October 31. (Microsoft DCU; Microsoft technical analysis; preliminary injunction)
Reported impact
Microsoft attributes more than 12,000 compromised email inboxes across over 10,000 organizations worldwide to EvilTokens, with the highest observed victim activity in the United States, Canada, Britain, Australia, India and France. That is a Microsoft investigation figure, not a count of proven AI-analyzed inboxes or completed frauds. Coinbase says some customers were persuaded by manipulated emails to transfer cryptocurrency; it says Coinbase accounts and credentials were not compromised. Microsoft says it cannot estimate total fraud. A Microsoft spokesperson told CyberScoop that the company had linked at least 13 complaints filed with the FBI's Internet Crime Complaint Center to EvilTokens activity, representing about $1.7 million in reported losses, and called the figure a conservative estimate. That figure is a partial, unaudited floor, not a reliable total of victim losses. The spokesperson also said about 1,000 cybercriminals used the service. (Microsoft DCU; Coinbase; CyberScoop)
What happened
The attacker initiated a legitimate Microsoft device-code sign-in and presented its code through a phishing lure. When a recipient entered the code on Microsoft's site and completed authentication, the attacker-controlled session received account access without learning the password. Sekoia documented EvilTokens phishing pages and backend code in March; Microsoft later tracked the actor behind development and support as Storm-2992. (Sekoia, part 1; Microsoft technical analysis)
The service also offered an AI-assisted workflow for summarizing mailbox content, finding payment relationships and drafting tailored approaches. Sekoia publicly described these capabilities in April, months before the September disruption. Microsoft reports at least one observed incident in which the actor used the AI capability to filter high-value users. It also describes observed follow-on actions that include inbox rules, email exfiltration and device registration, but its public material does not show that every compromised inbox went through those steps or the AI workflow. (Sekoia, part 2; Microsoft technical analysis)
How the boundary failed
Phishing lure → attacker-supplied device code → real Microsoft sign-in → victim approves attacker-controlled session → attacker obtains OAuth access and refresh tokens → mailbox access. Microsoft observed AI-assisted target selection in one incident; its use across the wider victim set is unquantified. The trust boundary failed when a valid user authorization was applied to the attacker's session. The legitimate login page and completion of ordinary authentication did not make the request safe. (Microsoft technical analysis; Sekoia, part 1)
Consequences
Captured OAuth tokens allowed access to account resources; Microsoft describes cases involving email exfiltration, malicious inbox rules and new device registration. Those are observed behaviors, not a demonstrated outcome for every inbox in its total. Access to correspondence could expose sensitive business relationships and payment processes. Coinbase reports customer transfers prompted by impersonation, while expressly excluding a breach of its own customer accounts or credentials. The number of completed frauds, the total value lost by victims and the number of mailboxes processed through AI remain unknown; Microsoft's figure of about $1.7 million across 13 FBI complaints is a partial floor. (Microsoft technical analysis; Coinbase; CyberScoop)
Vendor response
On September 22, Microsoft said it and partners seized 50 EvilTokens websites, disabled more than 150 supporting domains, notified affected customers and helped remediate compromised accounts. Health-ISAC joined the civil action, and Coinbase described its part in the disruption. These are announced actions; the reviewed public sources do not quantify any residual attacker access after the takedown. Microsoft advises revoking affected sessions and tokens because a password reset alone may leave an authorized session active. (Microsoft DCU; Health-ISAC)
Official oversight
Checked October 31, 2026, for United States and United Kingdom actions specific to this service.
| Authority | Action on this incident | Status / basis | Next step | Official source |
|---|---|---|---|---|
| U.S. District Court, Eastern District of Virginia | Entered a temporary restraining order on September 15 and granted a preliminary injunction in an order filed October 5, 2026, in Microsoft and Health-ISAC's civil action, No. 1:26-cv-3047. The injunction bars the defendants from operating EvilTokens infrastructure and keeps the seized control-panel domains under Microsoft's control and the phishing domains on hold, pending final judgment or further order. | Preliminary relief. The court found the plaintiffs likely to prevail on an uncontested record; the defendants had not appeared. The complaint’s account of defendants and conduct remains allegations. No final judgment appeared in the reviewed public materials; the official PACER docket was not accessed. | Watch for a default judgment or final judgment. | Complaint; TRO; preliminary injunction; filings page |
| Metropolitan Police Service, United Kingdom | A Met spokesperson confirmed to The Record two arrests on suspicion of making articles for use in fraud and money laundering offenses, and said Microsoft reported the matter in August. Both men were released on bail. | Microsoft and CyberScoop reported on September 22 that the investigation was continuing; no charge decision was found in the reviewed public sources through October 31. Microsoft dates the arrests to September 11; the Met spokesperson's “last Friday” statement published by The Record on September 22 implies September 18. No incident-specific Met press release was located. | Watch for a charge decision. | The Record; Microsoft DCU; CyberScoop |
What remains open
Established in this record
Sekoia and Microsoft describe the device-code phishing mechanism and AI-capable mailbox analysis, and Microsoft reports actual AI use in one observed incident. Sekoia's April report places the AI workflow in the public record before the September disruption. The federal court has granted a preliminary injunction on an uncontested record, and a Metropolitan Police spokesperson confirmed two arrests. Microsoft's victim total remains an attributed investigation finding. (Sekoia, part 2; preliminary injunction; The Record)
Still unknown
How many of the compromised inboxes underwent AI analysis or were used for a completed fraud? What victim losses can be documented beyond Microsoft's partial figure of about $1.7 million across 13 FBI complaints? Were the two men arrested on September 11 or September 18, and will they be charged? Coinbase attributed about $1.1 million in platform revenue across four Tron addresses from October 2025 through June 2026, while Sekoia documents sale of the named kit from February 17, 2026. Public evidence does not explain the earlier receipts; precursor or broader operator activity and a date or labeling error remain possibilities. (Coinbase; Sekoia, part 2; CyberScoop; The Record)
Next reporting step
Seek Microsoft's counting method and an AI-use denominator, Coinbase's basis for attributing 2025 payments, any default or final judgment in the civil case, and a charge decision by the Metropolitan Police. No outreach has been sent.
Record updates
-
October 31, 2026: Follow-up check. The court's preliminary-injunction order, filed October 5, shows that the temporary restraining order was entered September 15 and that the defendants had not appeared or otherwise responded to the order to show cause. Added the Metropolitan Police's confirmation of the two arrests and the suspected offenses, as reported by The Record on September 22, and the conflicting arrest dates (Microsoft gives September 11; the Met's "last Friday" implies September 18). Added a Microsoft spokesperson's statement to CyberScoop, published September 22, that 13 FBI complaints representing about $1.7 million in reported losses are linked to the service and that about 1,000 cybercriminals used it. No counting method for the 12,000-inbox figure or AI-use denominator was found in the reviewed Microsoft material, and Coinbase's attribution of pre-launch payments remains unexplained.
-
September 23, 2026: Initial source-checked record published as IB–2026–010. Primary technical reports and interim court papers reviewed; victim count, AI-use prevalence, fraud losses and pre-launch payment attribution remain limited or unresolved.