Microsoft Says It Seized 50 Websites and Disabled 150-Plus Domains Tied to AI-Assisted EvilTokens Phishing Service

Microsoft says it seized 50 websites and disabled more than 150 other domains in a disruption of EvilTokens, a subscription cybercrime platform that used an AI chatbot to help break into email accounts and plan financial fraud. The company announced the action on Sept. 22, 2026. Circleid reports that the US District Court for the Eastern District of Virginia authorized it.

Microsoft links the service to more than 12,000 compromised email accounts at over 10,000 organizations worldwide within months of its February 2026 launch, according to Ars Technica. The count covers inboxes and accounts Microsoft ties to the service.

Circleid reports that Microsoft describes the case as the first time it has gone after a cybercrime service that is AI-enabled from front to back.

How the takeover worked

Initial access relied on device-code phishing, according to Ars Technica and SecurityWeek. Device-code sign-in is an OAuth 2.0 flow built for devices with limited input, such as TVs and printers. Victims were induced to enter an attacker-generated code on Microsoft’s real sign-in page, which gave attackers tokens without needing the victim’s password.

That is why checking the web address offers little help here: the sign-in page itself was genuine.

SecurityWeek and The Hacker News report the platform offered 44 lure themes. They also describe evasion techniques including fake CAPTCHAs, redirect chains and serverless hosting on Vercel, Cloudflare Workers and AWS Lambda.

Where the AI came in

Once an inbox was compromised, the AI component analyzed it, according to Ars Technica’s account of Microsoft’s findings. It looked for trusted relationships, payment authorizations, wire-transfer talks, vendor invoices and employees who can move money. It also recommended whom to impersonate and drafted the impersonation messages.

Capabilities that once required experience across identity attacks, cloud systems, social engineering, and financial fraud were available through a ready-made interface.

Microsoft, The Hacker News

SecurityWeek reports Microsoft believes the platform was itself largely built with AI help. The Hacker News described it as vibe coded, meaning written largely by prompting an AI model.

The price of entry

EvilTokens was sold through Telegram for a $1,500 initial fee plus $500 a month, according to Ars Technica and SecurityWeek. Sekoia said the one-time fee gave lifetime access to the admin panel, while the monthly charge covered the phishing page code and an API key.

The Hacker News reports that Coinbase traced roughly $1.1 million in takings to four Tron addresses from October 2025 through June 2026, with over 1,000 deposits from over 700 addresses.

The Hacker News also reports that Huntress first documented EvilTokens in March 2026, and that Sekoia described it as a turnkey phishing-as-a-service offering sold on Telegram since mid-February. Phishing-as-a-service means criminals rent phishing tools the way businesses rent software.

Who was hit, and how the counts differ

SecurityWeek reports victim activity was concentrated in the US, followed by Canada, the UK, Australia, India and France. Targets spanned distributors, builders, banks, property firms, universities and healthcare providers.

SpyCloud reported a narrower figure from its own recaptured phished data: 8,708 unique victim accounts across 6,585 corporate email domains in 79 countries, according to CISO Platform. That is a different dataset from Microsoft’s, so the two numbers do not measure the same thing.

Arrests and defendants

The Metropolitan Police arrested two men, aged 32 and 38, in connection with EvilTokens, and both were released on conditional bail, according to Ars Technica. Circleid, Tech Journal and The Hacker News give an arrest date of Sept. 11. CISO Platform says Sept.

19.

Microsoft’s civil complaint, case number 1:26-cv-3047, names Felix Utomi and Waidi Segun Adams as defendants, along with unnamed individuals, according to SecurityWeek and Tech Journal. News4hackers and SecurityWeek identify those two as the men arrested.

SecurityWeek and The Hacker News list the partners in the disruption: Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, the Shadowserver Foundation and TRM Labs.

What the takedown does not stop

Microsoft warned that attacker access could persist after a password reset unless the associated sessions and tokens were also revoked, according to Tech Journal. A token is a credential issued after sign-in, and changing the password does not necessarily cancel one already issued.

Tech Journal says a disruption does not automatically remove stolen data or invalidate tokens already collected. CISO Platform says the threat remains active, though attack volume should drop. CISO Platform also says clones such as APToken have been built on the same toolkit. That claim comes from CISO Platform alone.

Why it matters

This is analysis. A service priced at $500 a month after a $1,500 buy-in, which automates mailbox triage and message drafting, lowers the skill needed for payment fraud if Microsoft’s description holds.

The seizures hit websites and domains. By Tech Journal’s account they do not automatically reach tokens already collected, and a toolkit that exists in copies, as CISO Platform describes, is harder to remove than one storefront.

How to spot it

The scheme’s tell was the prompt. Victims were asked to enter an attacker-generated code on a genuine Microsoft sign-in page, according to Ars Technica and SecurityWeek.

If a message, call or page asks you to type in a code you did not start yourself, stop. And if an account may be compromised, Microsoft’s warning is that a password change alone may not shut the attacker out.