Microsoft-Led Coalition Takes Down EvilTokens AI-Powered Phishing-as-a-Service Platform (Storm-2992)
Microsoft-Led Coalition Takes Down EvilTokens AI-Powered (TL-2026-2614), also tracked as EvilTokens, is a high-severity tracked intrusion set, first published 2026-09-22. It is attributed to Storm-2992 with high confidence, affects Microsoft Microsoft 365 / Entra ID — OAuth 2.0 Device Authorization, maps to 18 MITRE ATT&CK techniques (T1087.004, T1098.005, T1114.002), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-2614
- Threat ID
- TL-2026-2614
- Also known as
- EvilTokens, Storm-2992
- Severity
- HIGH
- Status
- MITIGATED
- Category
- THREAT_INTEL
- First published
- 2026-09-22
- Last reviewed
- 2026-09-22
- Attribution
- Storm-2992
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- financial services, health, government administration, legal services, construction, manufacturing, nonprofit, real estate, logistics, human resources
- Target regions
- North America, Europe, Middle East, Asia, Oceania
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Microsoft-Led Coalition Takes Down EvilTokens AI-Powered
Malware and tooling: Storm, EvilTokens
A Microsoft-led coalition (Health-ISAC, Cloudflare, OpenAI, Shadowserver, TRM Labs, SpyCloud, Coinbase, UK Metropolitan Police) obtained a federal court order on September 15, 2026 to seize 50 websites and 175+ supporting domains behind EvilTokens, an AI-augmented device-code phishing-as-a-service platform tracked as Storm-2992 that stole OAuth session/refresh tokens to bypass MFA and drove business email compromise at scale. Two operators (32 and 38) were arrested in Canary Wharf and Nine Elms, London on September 18, 2026; roughly 1,000 subscribers used the kit to compromise 12,000+ Microsoft 365 inboxes across 10,000+ organizations in 79 countries.
How Microsoft-Led Coalition Takes Down EvilTokens AI-Powered works
EvilTokens is a subscription phishing-as-a-service (PhaaS) kit, first observed mid-February 2026 and sold openly over Telegram, that weaponizes the OAuth 2.0 Device Authorization Grant — the flow Microsoft designed to let keyboardless devices (smart TVs, printers, Teams room devices) authenticate — to hijack Microsoft 365 accounts without ever touching a password or a fake login page. An operator requests a legitimate Microsoft device code and user code, then delivers it to a victim through a socially-engineered lure (fake Adobe Acrobat/DocuSign requests, invoice approvals, SharePoint notifications, payroll or security alerts, sometimes via PDF/HTML/DOCX/XLSX/SVG attachments carrying QR codes). The victim is directed to the real microsoft.com/devicelogin page, enters the code, and completes their own MFA challenge on genuine Microsoft infrastructure — at which point Microsoft issues the access and refresh tokens to the attacker's polling session instead of the victim's. The 90-day rolling refresh token survives password resets and is not revoked by MFA re-enrollment, only by an explicit revokeSignInSessions call; some operators additionally register a device against the stolen refresh token to mint a Primary Refresh Token (PRT), extending silent access and in some cases sidestepping device-compliance Conditional Access checks.
EvilTokens escalated the technique — first weaponized by the Russian state actor Storm-2372 in campaigns Microsoft disclosed in February 2025, then commoditized by the financially motivated group TA2723 by September 2025 — into a fully AI-driven commercial platform. Internally it pipelines three LLMs: Meta Llama 3.1 (8B) to ingest up to 5,000 harvested emails per mailbox and flag exploitable payment threads, Meta Llama 3.3 (70B) to draft contextually tailored business-email-compromise messages, and OpenAI GPT-4o mini to machine-translate stolen mail for multilingual targeting — automating what used to require a human operator reading a compromised inbox. The kit ran on Cloudflare Workers (brand-impersonating *.workers.dev landing pages such as adobe-[a-z0-9]{3}.*-s-account.workers.dev) fronted by Railway.com-hosted Node.js polling infrastructure that spun up thousands of short-lived device-code-polling nodes, plus roughly 32 self-hosted affiliate domains and a webmail-style admin panel for direct mailbox access, forwarding-rule abuse, and outbound BEC/invoice-fraud campaigns. Pricing ran $1,500 one-time plus $500/month for the core Office 365 device-code kit, with add-ons ($600 B2B sender module, $1,000 SMTP sender, $500 lifetime multi-account portal license) sold through a Telegram bot network run under the operator alias 'eviltokensadmin'; roughly 280 subscribers were in the private channel by March 19, 2026, growing to an estimated 1,000 active users and over 1,000 phishing domains by the time of takedown.
A Microsoft Digital Crimes Unit (DCU)-led coalition — Health-ISAC, Cloudflare, OpenAI, Shadowserver, TRM Labs, SpyCloud, Coinbase, and the UK Metropolitan Police Service — obtained a US federal court order on September 15, 2026 authorizing seizure of 50 websites and 175+ supporting domains. SpyCloud identified 8,708 compromised accounts across 6,585 corporate domains (97.5% enterprise) spanning 79 countries, led by the US, Canada, Australia, UK, and Saudi Arabia. Coinbase traced roughly $1.1 million in subscriber deposits across 1,000+ transactions from 700+ distinct cryptocurrency addresses through June 2026; the FBI's Internet Crime Complaint Center separately linked 13+ complaints totaling roughly $1.7 million in reported losses — both figures acknowledged as conservative given underreporting. On September 18, 2026, the Metropolitan Police Service executed warrants at addresses in Canary Wharf and Nine Elms, arresting two men (32 and 38) suspected of administering the EvilTokens site; both were released on bail pending further investigation. Microsoft's Associate General Counsel Steven Masada characterized the shift bluntly: 'AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible.' Microsoft and Metropolitan Police officials both cautioned that seizing infrastructure disrupts but does not eliminate the underlying technique — a related PhaaS operation, Tycoon 2FA, resumed device-code phishing from backed-up codebases within weeks of its own March 2026 coalition takedown.
MITRE ATT&CK techniques used in TL-2026-2614
Discovery
Persistence
Collection
T1114.002 Remote Email Collection; T1114.003 Email Forwarding Rule; T1119 Automated Collection; T1213.002 Sharepoint
Credential Access
T1187 Forced Authentication; T1528 Steal Application Access Token
Execution
Lateral Movement
lateral-movement
T1550.001 Application Access Token
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Resource Development
T1583.006 Web Services; T1588.002 Tool
Reconnaissance
Impact
Defense Evasion
Affected products and versions in Microsoft-Led Coalition Takes Down EvilTokens AI-Powered
- Microsoft — Microsoft 365 / Entra ID — OAuth 2.0 Device Authorization Grant (device code flow)
Vulnerable versions: any Entra ID tenant with device code authentication enabled and not restricted by Conditional Access
Fixed in: not applicable — protocol-abuse, not a software vulnerability; mitigated via Conditional Access policies blocking/restricting Device Code Flow and mandatory refresh-token revocation
Remediation for Microsoft-Led Coalition Takes Down EvilTokens AI-Powered
Patches
- No vendor patch applies — EvilTokens abuses legitimate OAuth 2.0 Device Authorization Grant behavior (RFC 8628) rather than a software defect; mitigation is policy-based (Conditional Access), not patch-based
Immediate actions
- Block or tightly restrict the OAuth 2.0 Device Authorization Grant flow via Conditional Access for all users/applications without a documented business need (kiosks, IoT, print and meeting-room devices)
- Query 90 days of Entra ID sign-in logs for authenticationProtocol: deviceCode / originalTransferMethod: deviceCodeFlow and investigate any occurrence outside an approved baseline
- For any suspected compromise, immediately call revokeSignInSessions via Microsoft Graph — password resets alone do NOT invalidate the 90-day refresh tokens EvilTokens harvests
- Add the observed Railway.com polling-node IP ranges (162.220.232.0/24, 162.220.234.0/24) to Entra ID Named Locations with block policies, or block at the network perimeter
- Audit and remove unauthorized device registrations created in Entra ID within 48 hours of any suspicious device-code sign-in, and review mailbox forwarding/inbox rules created in the same window
Workarounds
- Where device code flow cannot be fully disabled, restrict polling/authorization to documented corporate egress IP ranges via Conditional Access location policies
- Enable Safe Links and anti-phishing policies in Microsoft Defender for Office 365 tuned to lures impersonating Adobe Acrobat, DocuSign, and SharePoint/payroll notifications
Longer-term hardening
- Deprecate device code flow organization-wide via Conditional Access and require phishing-resistant authentication (FIDO2 security keys, Windows Hello for Business, Authenticator with passkey) for all users
- Build identity-layer detection around Entra ID Protection signals (RiskLevelDuringSignIn, ErrorCode 50199 followed by success within 5 minutes) rather than relying on email-gateway or endpoint controls, since device-code phishing produces no malicious attachment or credential-harvesting page for them to catch
- Implement periodic OAuth application-consent and device-registration attestation reviews across the tenant
- Apply least-privilege Microsoft Graph API scopes and alert on bulk mailbox/SharePoint/OneDrive access patterns consistent with automated, AI-driven inbox triage
Timeline of Microsoft-Led Coalition Takes Down EvilTokens AI-Powered
- Microsoft publicly discloses Storm-2372, the Russian state actor whose device-code phishing campaigns against government/academic targets pioneered the technique EvilTokens later commoditized.
- Financially motivated group TA2723 commoditizes device-code phishing outside state-sponsored operations, per Cloud Security Alliance research note timeline.
- EvilTokens phishing-as-a-service kit launches, first offering device-code authentication abuse at commercial scale with AI-assisted lure generation.
- Huntress identifies the first EvilTokens-driven compromise wave; within five weeks the campaign reaches 340+ Microsoft 365 organizations across seven countries.
- EvilTokens' private Telegram subscriber channel reaches roughly 280 members.
- EvilTokens phishing infrastructure surpasses 1,000 live domains hosting device-code phishing pages, per Sekoia tracking.
- Microsoft Security Blog documents a significant AI-enabled escalation of device-code phishing tied to the EvilTokens PhaaS toolkit, publishing IOCs and hunting queries.
- Coinbase's tracing window closes having identified roughly $1.1 million in subscriber deposits across 1,000+ transactions from 700+ distinct cryptocurrency addresses tied to EvilTokens.
- Microsoft receives information identifying EvilTokens' operators and notifies the UK Metropolitan Police Service.
- A US federal court grants the coalition's order authorizing seizure of 50 EvilTokens websites and 175+ supporting domains.
- UK Metropolitan Police execute warrants at addresses in Canary Wharf and Nine Elms, London, arresting two men aged 32 and 38 suspected of administering EvilTokens; both are released on bail.
- Microsoft's Digital Crimes Unit and coalition partners publicly disclose the takedown, victim scale (12,000+ inboxes, 10,000+ organizations, 79 countries), and FBI IC3-linked loss figures (~$1.7M across 13+ complaints).
Sources cited for Microsoft-Led Coalition Takes Down EvilTokens AI-Powered
- Microsoft-led coalition dismantles EvilTokens cybercrime-as-a-service operation
- EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
- New EvilTokens service fuels Microsoft device code phishing attacks
- Storm-2372 conducts device code phishing campaign
- Inside an AI-enabled device code phishing campaign
- New widespread EvilTokens kit: device code phishing as-a-service (Part 1)
- EvilTokens and the Rise of AI-Powered Phishing
- EvilTokens abuses Microsoft device code flow for account takeovers
- CSA Research Note: EvilTokens — Device-Code Phishing Renders MFA Irrelevant
- CSA Research Note: OAuth Device Code Phishing and Microsoft 365
- EvilTokens: The Phishing Kit That Renders Your MFA Useless
More in threat intel
- Iran Exploits SS7 Cellular Interconnect Infrastructure to Track US Military Personnel
- Google Gemini AI Model Autonomously Breached Three Real Companies During Authorized Security Evaluation
- LLM-Driven Reverse Engineering of Palo Alto Cortex XDR Yields Working EDR Evasion (SpecterOps)
- France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Months
- FBI, DOJ, and RCMP Seize NightmareStresser DDoS-for-Hire Domains in Latest Operation PowerOFF Action
Detection coverage for TL-2026-2614
As of 2026-09-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2614 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.