GoKawiilMicrosoft-led coalition dismantles EvilTokens AI phishing-as-a-service network
Microsoft and partners including Cloudflare, Coinbase, OpenAI, SpyCloud, TRM Labs and Health-ISAC disrupted EvilTokens, a phishing-as-a-service platform that used AI to scan compromised inboxes and craft tailored lures. The operation had compromised over 12,000 inboxes across more than 10,000 organizations worldwide, spanning sectors like healthcare, finance and higher education. The takedown seized 50 sites and disabled 150 domains, and UK police arrested two men, aged 32 and 38, after Microsoft shared intelligence with the Metropolitan Police's cybercrime unit.
GoKawiil's interpretation of the reporting above, not reported fact.
The scale of coordination across hosting providers, cryptocurrency exchanges, AI model providers and data holders suggests that disrupting AI-enabled cybercrime now requires simultaneous multi-industry action rather than any single company acting alone. Microsoft's use of AI-powered tools to reverse-engineer the criminals' own AI infrastructure points to an emerging pattern where defenders adopt the same technology attackers use, potentially setting a template for future takedowns. The case also illustrates how AI can lower the skill barrier for large-scale, targeted phishing, which may prompt organizations to reassess email security defenses.
- EvilTokens compromised over 12,000 inboxes across 10,000+ organizations using AI-tailored phishing lures.
- A coalition of Microsoft, Cloudflare, Coinbase, OpenAI and others seized 50 sites and disabled 150 domains.
- UK Metropolitan Police arrested two men after Microsoft shared intelligence gathered through AI-assisted investigation.
YubiKey 5 NFC Security Key — With phishing-as-a-service platforms automating credential theft at massive scale, hardware-backed two-factor authentication is one of the strongest defenses against account takeover. A YubiKey makes it dramatically harder for attackers to hijack business email accounts even if passwords are stolen through AI-crafted phishing lures. It's a simple, durable way to add real security to email and cloud accounts mentioned in this story.”}, wait that's malformed—fix. Correction below. {
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: yro.slashdot.org — Posted, 2026-09-23
Published there as: “Microsoft Helps Take Down Massive Automated, AI-Powered Phishing-as-a-Service Platform”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.