Microsoft announced on Tuesday that it disrupted EvilTokens, an AI-powered phishing platform used by cybercriminals to target many organizations worldwide.
EvilTokens emerged in February 2026, and according to Microsoft, it has been used to compromise more than 12,000 email accounts at over 10,000 organizations, including in the US, Canada, the UK, Australia, India, and France.
The platform enabled threat actors to gain access to targeted accounts via device code phishing, which targets the device code authentication flow designed for devices that don’t support standard login methods, such as TVs and printers. The authentication process requires the user to enter a short code presented on the device into a web browser session on a separate device.
Threat actors can abuse this by initiating the authentication flow and providing the code to the targeted user via a phishing lure. If the user is convinced to complete the authentication process in a browser using the attacker’s code, they are giving the attacker access to the account without handing over passwords.
EvilTokens facilitated this process, making it easier for cybercriminals to obtain access tokens that could provide persistent access to email accounts.
The platform used AI throughout the attack chain, including to create phishing emails customized for specific targets to increase the chances of success. EvilTokens offered 44 different themes for the malicious emails and phishing pages.
Once access was gained to an account, AI helped EvilTokens users go through victims’ inboxes for valuable data. “[AI] helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible,” Microsoft said.