MSFT · News · 20260922N

AI Cybercrime Disruption

MICROSOFT CORP · 2026-09-22 · Importance 31 · Surprise 42

Microsoft and partners, working with law enforcement, disrupted EvilTokens, an AI-powered device-code phishing service tied to more than 12,000 inbox compromises across 10,000 organizations worldwide. The operation seized 50 websites and disabled more than 150 additional domains used by the service. Two individuals were arrested in connection with the takedown, which targeted AI-enabled email compromise and financial fraud.

Key facts

• Microsoft, in collaboration with several partners and law enforcement, announced the takedown of EvilTokens, an AI-powered device-code phishing service that led to over 12,000 inbox compromises across 10,000 organizations worldwide. source
• The operation to disrupt EvilTokens involved seizing 50 websites and disabling over 150 additional domains, with two arrests made in connection with the service. source