Microsoft Disrupts AI-Powered Phishing Platform and Arrests Suspects

Microsoft has disrupted EvilTokens, an artificial intelligence-driven phishing platform that compromised more than 12,000 email accounts across 10,000 organisations globally.

The platform, which emerged in February 2026, leveraged AI to automate the entire attack chain. This included using AI to draft highly customised social engineering messages and to identify high-value targets within victim inboxes. Microsoft believes the platform itself may have been coded using AI, offering 44 different themes for malicious emails and phishing pages.

Attackers primarily utilised device code phishing to gain unauthorised access. This technique exploits authentication flows designed for devices that do not support standard login methods, such as smart TVs or printers. By tricking a user into entering a code provided by the attacker into a browser session, the threat actors could obtain access tokens. This method allowed for persistent access to accounts without the attackers ever needing to obtain a password.

The scale of the EvilTokens phishing disruption highlights the growing complexity of AI-assisted cybercrime. The impact was felt in the United States, Canada, the United Kingdom, Australia, India, and France.

In a coordinated effort involving partners such as OpenAI, Cloudflare, and SpyCloud, Microsoft seized 50 websites and disabled more than 150 domains associated with the platform’s infrastructure. The disruption was supported by several other organisations, including TRM Labs, Coinbase, and the Shadowserver Foundation.

Two men, identified in a Microsoft complaint as Felix Utomi and Waidi Segun Adams, have been arrested in the United Kingdom in connection with the operation. The legal complaint also names five other unnamed individuals suspected of involvement.

To use the service, cybercriminals were required to pay an initial access fee of $1,500, followed by a $500 monthly subscription.