Microsoft Takes Down Evil Tokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Summary: Microsoft announced the takedown of the EvilTokens device-code phishing service, carried out with authorization from the U.S. District Court for the Eastern District of Virginia and with support from Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs; the U.K. Metropolitan Police Service arrested two men, aged 32 and 38, on September 11, 2026. Microsoft attributes more than 12,000 compromised email inboxes across over 10,000 organizations to EvilTokens, which abused the OAuth 2.0 device authorization flow to obtain access and refresh tokens without needing victim credentials, and seized 50 websites and disabled over 150 additional domains.
Why it matters: SpyCloud shared 8,708 unique victim accounts across 6,585 corporate email domains in 79 countries, and Microsoft notes that access could persist after a password reset if the associated sessions and tokens were not also revoked.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026