Observed incident

EvilTokens combined account compromise with AI-assisted fraud preparation

Reported

What happened

Huntress traced a Microsoft 365 device-code phishing campaign to EvilTokens. Microsoft later documented its AI-assisted mailbox analysis, target selection, impersonation planning, and fraud preparation.

Parties and reporting

AI tools and systems: EvilTokens, Microsoft 365, Commercial AI models, Railway

Outcome

In September, Microsoft reported 50 websites seized, over 150 supporting domains disabled and two arrests. An October preliminary injunction maintained domain restrictions pending final judgment; the investigation continues.

Operating lesson

Restrict device-code authentication where unnecessary, revoke stolen tokens, and monitor suspicious mailbox access and forwarding.

Evidence and limits

Huntress named EvilTokens in a March 23 update; initial AI involvement was partly inferred. Microsoft's September investigation provides stronger evidence. The injunction was filed October 5; Microsoft's index labels it October 6. Its web-posting date is unconfirmed. Preliminary relief is not a final liability finding; arrests are not convictions.

Sources