Microsoft and a group of private and public sector organizations recently disrupted EvilTokens, a phishing-as-a-service (PhaaS) provider that rose to prominence earlier this year.
EvilTokens is a cybercrime platform that sets threat actors up with a suite of AI-powered tools to conduct phishing campaigns. Its capabilities include phishing lure crafting and analysis of compromised inboxes to identify possible targets. As Microsoft explained in a blog post published today, "This AI-powered cybercrime platform facilitated sophisticated business email compromise (BEC) campaigns that compromised more than 12,000 inboxes in over 10,000 organizations worldwide."
Microsoft identifies the operators behind EvilTokens as "Storm-2992."
This month, Microsoft, along with several partners, seized EvilTokens infrastructure as part of US court-enabled legal action. Microsoft said in a separate blog that it "seized 50 websites used to operate the service and disabled more than 150 additional domains tied to its supporting infrastructure." Furthermore, the UK's Metropolitan Police Service cybercrime team arrested two men earlier this month suspected of crimes connected to this campaign. Both men have been released on bail as the investigation continues.