EvilTokens
Narrative intelligence for EvilTokens: 5 tracked articles, claims, and spin patterns across AI and technology coverage.
Related Articles
Microsoft Disrupts EvilTokens Device Code Phishing Service
Microsoft executed a technical and legal operation to dismantle EvilTokens, a phishing-as-a-service platform that weaponized device code authentication flows to compromise Microsoft 365 accounts.
Sep 23, 2026
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft led a court-authorized takedown of the EvilTokens phishing service, which allegedly used AI throughout its attack chain and compromised approximately 12,000 inboxes.
Sep 22, 2026
Microsoft and Coinbase probe leads to arrest of crooks behind 'EvilTokens', a DIY phishing network powered by AI - Fortune
Law enforcement arrested individuals allegedly operating 'EvilTokens', an AI-powered DIY phishing toolkit, following a joint investigation by Microsoft and Coinbase.
Sep 23, 2026
New Ghost Phishing Wave Is Breaking Traditional Email Security
A new 'ghost phishing' technique used in an EvilTokens campaign evades traditional email security by delaying malicious payload decryption until execution inside the victim's browser, creating a detection gap for URL-based filters.
Jul 9, 2026
ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit
A newly identified phishing-as-a-service platform named ARToken, linked to the EvilTokens operation, reveals an advanced, modular toolkit targeting Microsoft 365 accounts — highlighting evolving adversary infrastructure and detection challenges.
Published Jul 3, 2026 · Analyzed Jul 7, 2026
Related Claims
01 EvilTokens used artificial intelligence 'at every step of the attack chain.'
02 This 'ghost phishing' technique keeps the malicious page hidden until it decrypts and comes to life inside the victim’s browser.
03 Microsoft and Coinbase probe leads to arrest of crooks behind 'EvilTokens', a DIY phishing network powered by AI
04 ARToken appears to operate as an affiliate of the EvilTokens phishing platform
05 Microsoft seized 50 websites and disabled more than 150 domains as part of a coordinated disruption effort against a phishing-as-a-service platform targeting Microsoft 365 accounts.
Markdown (.md) · JSON-LD schema (.json) · Machine-readable for AI & GEO