AI-Driven EvilTokens Platform Accelerates Microsoft 365 Phishing Attacks

The “EvilTokens” phishing-as-a-service platform has emerged as a primary example of how artificial intelligence is being integrated into the cyberattack lifecycle to bypass traditional security defences. By automating the analysis of compromised environments, the tool allows attackers to identify high-value targets and execute fraud within Microsoft 365 inboxes far faster than manual methods allow.

First identified in February 2026, the service leverages a specific exploitation of the OAuth 2.0 device authorization grant flow. Unlike conventional phishing, which relies on fraudulent login pages to harvest credentials, EvilTokens convinces victims to authorise attacker access directly through legitimate Microsoft authentication prompts. This method effectively bypasses many standard identity protections by using the platform’s own legitimate authentication mechanisms.

AI Automation Across the Attack Chain

Microsoft researchers, who tracked the infrastructure behind the scheme to a threat actor known as Storm-2992, noted that the operation utilised AI at nearly every stage of the attack chain. Following a successful takedown of the group’s infrastructure in September, analysis revealed that once initial access is gained, AI-driven tools are used to rapidly sift through a victim’s digital environment.

The platform’s AI capabilities are designed to remove the “friction” that typically slows down human attackers. The system can automatically identify individuals who control financial payments, map out trusted business relationships, and flag specific invoices or transactions that are ripe for exploitation. Furthermore, the AI can draft convincing, context-aware fraudulent messages based on existing business conversations to facilitate sophisticated impersonation attacks.

Challenges to Traditional Security Metrics

The speed provided by AI-assisted analysis is forcing security teams to reconsider traditional performance indicators. Standard metrics such as mean-time-to-detect (MTTD) and mean-time-to-respond (MTTR) may no longer be sufficient if an attacker can achieve their objectives within the first few minutes of a compromise.

Technical analysis from cybersecurity firm SimSpace suggests that as AI compresses the timeline between initial access and final impact, detection must trigger immediate, automated containment to be effective. A detection that occurs after an attacker has already established persistence or identified their targets carries significantly less value than one that interrupts the initial foothold before the AI-driven analysis begins.

Moving Toward Preemptive Security

To counter these high-speed threats, organisations are being urged to move toward “preemptive security.” This involves testing security controls as an integrated system rather than in isolation. Because EvilTokens-style attacks interact with email security, identity verification, and network monitoring simultaneously, defenders need to understand how these layers perform together during a complete attack path.

By recreating realistic AI-assisted attack scenarios, security teams can identify where an attacker is likely to make progress before an incident occurs. Addressing these systemic weaknesses in advance reduces the reliance on winning a race against an automated adversary that can operate with greater scale and stamina than human security analysts.

Microsoft continues to monitor for variations of the OAuth exploitation technique, advising administrators to review device code flow settings and enforce strict conditional access policies to mitigate the risk of unauthorised token generation.