The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In September 2026, Microsoft successfully disrupted EvilTokens, a sophisticated phishing-as-a-service (PhaaS) platform operated by threat actor Storm-2992. The AI-powered cybercrime service facilitated device code phishing attacks targeting Microsoft 365 accounts, compromising over 12,000 inboxes across 10,000+ organizations worldwide. Microsoft seized 50 websites and disabled 150+ domains, while UK authorities arrested two suspects. EvilTokens distinguished itself by automating device code authentication abuse at scale, using AI to craft tailored phishing lures, analyze compromised inboxes for high-value targets, and streamline business email compromise campaigns sold for $1,500 upfront plus $500 monthly via Telegram.

This incident highlights the alarming evolution of phishing-as-a-service platforms leveraging AI to democratize sophisticated attacks. As threat actors increasingly weaponize legitimate authentication mechanisms and AI capabilities, organizations face unprecedented challenges in defending against automated, scalable identity-based attacks that bypass traditional security controls.

Why This Matters Now

The EvilTokens disruption reveals how AI is accelerating the commoditization of advanced phishing techniques, making device code authentication abuse accessible to lower-skilled attackers. This trend demands immediate reassessment of identity security controls and authentication policies.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

EvilTokens specialized in automated device code phishing attacks and used AI to craft tailored lures, analyze compromised inboxes, and identify high-value targets for business email compromise campaigns.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely constrain this Microsoft 365 compromise by limiting organizational access scope and reducing lateral reconnaissance capabilities. East-west segmentation and egress controls could significantly reduce the blast radius of AI-powered data harvesting across compromised environments.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Identity-aware access controls would likely limit the scope of Microsoft 365 token permissions and reduce the organizational reach available through compromised device authentication flows

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Workload isolation and identity-scoped access policies would likely restrict Microsoft Graph API queries to specific organizational segments rather than allowing broad directory enumeration

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west segmentation would likely constrain cross-departmental email access and reduce the ability to correlate organizational relationships across isolated business units during reconnaissance activities

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized visibility and monitoring would likely detect anomalous Microsoft 365 session patterns and provide behavioral analysis of compromised token usage across cloud environments

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policies would likely limit bulk data extraction and constrain the volume of organizational intelligence that could be systematically harvested from compromised email environments

Impact (Mitigations)

While BEC campaigns could still occur, the reduced organizational intelligence and constrained reconnaissance scope would likely limit targeting precision and reduce the effectiveness of AI-crafted social engineering

Impact at a Glance

Affected Business Functions

  • Email Communications
  • Identity and Access Management
  • Financial Operations
  • Business Email Correspondence
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: N/A

Data Exposure

Compromised Microsoft 365 accounts across 12,000 inboxes in over 10,000 organizations spanning 79 countries. Exposed business email communications, organizational structures, payment authorities, and sensitive corporate relationships used for follow-on BEC attacks.

Recommended Actions

  • • Implement Zero Trust Segmentation with identity-based policies to prevent lateral movement between compromised accounts and sensitive organizational resources
  • • Deploy Egress Security & Policy Enforcement to block unauthorized Microsoft Graph API calls and data exfiltration to external domains
  • • Enable Multicloud Visibility & Control to detect anomalous authentication patterns and repeated API requests indicative of automated reconnaissance
  • • Configure Cloud Native Security Fabric (CNSF) with real-time inspection to identify and block device code phishing attempts at the network layer
  • • Establish Threat Detection & Anomaly Response capabilities to baseline normal Microsoft 365 usage patterns and alert on suspicious inbox analysis activities

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image