Microsoft Exposes EvilTokens: AI-Powered Phishing That Seized 12,000 Inboxes, Two Suspects Arrested

Microsoft, working with the London Metropolitan Police and a number of industry partners, succeeded in dismantling EvilTokens, a phishing-as-a-service (PhaaS) platform that had infected more than 12,000 email accounts at 10,000 organizations worldwide. In the operation, two men aged 32 and 38 were arrested, 50 websites were seized, and 150 domains were deactivated.

The arrests dealt a heavy blow to an increasingly organized cybercrime ecosystem. EvilTokens was first detected in February 2026 and quickly became one of the most popular PhaaS services. The platform was sold via Telegram for $1,500 for initial access, plus a $500 monthly subscription fee. Criminals could create fake websites, landing pages, and personalized phishing emails, and steal session tokens and two-factor authentication codes.

What set EvilTokens apart was its integration of artificial intelligence. The platform came with an AI assistant capable of scanning inboxes, recommending high-value targets, and even suggesting ways to approach victims. Microsoft found that most of the platform was built with AI assistance—a practice known as "vibe coding"—and relied on capabilities from various AI models. Overall, EvilTokens operated like a technology startup: it had subscription pricing, customer support, a management dashboard, and tools to move victims from account access to financial exploitation.

According to Microsoft's report, most victims came from the wholesale distribution, construction, and financial services sectors, although real estate, higher education, and healthcare were also affected. Most victims were in the United States, with significant numbers in Canada, the United Kingdom, Australia, India, and France. Microsoft has notified affected customers and helped restore compromised accounts.

"We are seeing a maturing phishing-as-a-service (PhaaS) market with threat actors increasingly integrating AI workflows into their product offerings," Huntress said in its report. "The results are visible directly in our telemetry: a 1,380% increase in detected device-code phishing attacks between July–December 2025 and January–April 2026, with more than 50% of incidents tied to two large waves of correlated incidents."

The device-code phishing technique itself is not new. In February 2025, security researchers at Huntress reported the Russian threat actor Storm-2372 using a similar method. However, its explosion in popularity only came after the emergence of EvilTokens. The platform allowed attackers to conduct Microsoft Graph reconnaissance, map organizational structures and access permissions, and move laterally within target networks.

For Indonesia, this development is a serious warning. As digital transformation accelerates in the financial, trade, and public services sectors, the attack surface widens. Global cybercriminals can easily access tools like EvilTokens and target organizations in Indonesia that may not yet have adequate defenses. Regulators such as OJK and BSSN need to strengthen the cybersecurity framework, while companies are encouraged to raise employee awareness of phishing and implement more robust multi-factor authentication.

Although two suspects have been arrested, it is not yet clear whether EvilTokens will truly die or return under a new guise. History shows that criminal infrastructure is often more vulnerable to arrests than to mere domain takedowns. The question is whether global law enforcement can keep pace with the rate of innovation of criminals now aided by AI, or whether it will fall behind.