Microsoft and its partners seized about 50 sites linked to a subscription-based attack platform, which compromised more than 12,000 boxes in 10,000 organizations.
A coalition led by Microsoft and Health-ISAC has taken down EvilTokens, a criminal platform sold on Telegram that offered the compromise of Microsoft 365 accounts as a subscription. More than 12,000 inboxes across more than 10,000 organizations have been affected since February 2026. Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, the Shadowserver Foundation, and TRM Labs participated in the operation: about fifty sites were seized and more than 150 infrastructure domains neutralized. Two men were arrested in the United Kingdom.
A chatbot at the heart of the attack chain
What distinguishes EvilTokens from traditional phishing kits is what happens after the intrusion. A chatbot would go through the stolen messaging, locate the employees authorized to trigger payments, and reconstruct the map of the victim's trusted relationships, executives, and external partners. It would search for invoices, transfer discussions, and executive correspondence, then recommend which identity to impersonate and what financial package to use.
The pricing was that of commercial software: $1,500 upon registration, $500 per month, and $600 to $1,000 per additional option, such as bulk SMTP sending. Microsoft places the highest concentrations of victims in the United States, Canada, the United Kingdom, Australia, India, and France, in industries ranging from retail and construction to finance, higher education, and healthcare.
Read the full article on the original source
Go to the source →