Microsoft-led operation disrupts phishing service tied to 12,000 accounts

Microsoft and partners disrupted infrastructure used by EvilTokens, a phishing-as-a-service operation linked to more than 12,000 compromised Microsoft inboxes across over 10,000 organizations. British police arrested two suspected administrators, who were released on bail pending further investigation. EvilTokens abused Microsoft's device-code authentication flow to obtain access tokens despite multifactor authentication, then used Microsoft Graph and AI tools to identify valuable messages and targets. The operation seized active infrastructure under legal authority, but Microsoft characterized it as a disruption rather than a complete takedown; the threat remains active and clones have appeared.