Microsoft has disrupted EvilTokens, an AI-powered cybercrime platform, working with U.K. police to arrest two suspected operators. U.K. officers executed warrants at two locations last Friday and arrested two men on suspicion of making articles for use in fraud and money laundering. Both were released on bail while the investigation continues. 

Microsoft reported the platform to London's Metropolitan Police Service in August.

With authorization from the U.S. District Court for the Eastern District of Virginia, Microsoft and health-sector non-profit Health-ISAC – which joined as co-plaintiff because healthcare organizations were among those targeted – worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs to dismantle the service, seizing 50 websites and disabling more than 150 additional domains. 

In the U.K., the Metropolitan Police Service's cybercrime team arrested two men, aged 32 and 38, on September 11, seizing digital devices for examination; both were released on bail. 

"Phishing services bring misery to thousands, taking money from everyday people across the world," said Detective Inspector Serena D'Adamo, who led the investigation. A Microsoft spokesperson said others may have supported the service beyond the two arrested men.

Launched in February 2026 and sold via Telegram, EvilTokens was linked within months to over 12,000 compromised inboxes across more than 10,000 organizations, with the heaviest victim concentrations in the U.S., Canada, U.K., Australia, India, and France, spanning wholesale distribution, construction, financial services, real estate, higher education, and healthcare. 

Victims were tricked into completing Microsoft's legitimate device-code sign-in flow, unknowingly handing attackers account access without revealing a password – access that could persist even after a reset if tokens weren't separately revoked. 

Once inside, its AI tools summarized and translated emails, mapped organizational roles, flagged wire-transfer discussions, and recommended which employees to impersonate.

Investigators found large portions of EvilTokens were "vibe coded" using multiple AI models. Microsoft says the case reflects a broader trend – increasingly capable, accessible AI being used to scale fraud and impersonation. 

The company's guidance for organizations is to:

• assume criminals can understand a compromised inbox within minutes rather than days,
• independently verify any request to change payment details or approve unusual transactions through a trusted second channel.

The company also worked with Cloudflare, Coinbase, The Shadowserver Foundation, and TRM Labs. This marks Microsoft Digital Crimes Unit's 40th court-authorized disruption overall and its first against what it calls an "end-to-end AI-enabled cybercrime service," following earlier actions against RaccoonO365 and RedVDS.

A June report presented EvilTokens as a phishing-as-a-service (PhaaS) kit built to compromise Microsoft 365 accounts by abusing the OAuth 2.0 device authorization grant flow.