EvilTokens Phishing-as-a-Service Platform Disrupted by Microsoft DCU

Microsoft's Digital Crimes Unit (DCU) has disrupted the EvilTokens Phishing-as-a-Service (PhaaS) platform, which was used by threat actors to compromise more than 12,000 Microsoft accounts at over 10,000 organizations globally. According to reporting by BleepingComputer, the operation targeted the infrastructure underpinning the PhaaS service, thereby disabling the phishing pages and token-stealing capabilities that had been deployed against Microsoft account holders.

The EvilTokens platform functioned as a Phishing-as-a-Service offering, allowing malicious actors to conduct credential phishing attacks. The service provided pre-built phishing pages designed to mimic legitimate Microsoft login interfaces, enabling threat actors to steal credentials and session tokens from unsuspecting users. The DCU's disruption effort, conducted in coordination with law enforcement partners, has taken the infrastructure offline.

The compromise of Microsoft accounts poses significant risks, including unauthorized access to email, cloud storage, and other integrated services. Session token theft can allow attackers to bypass multi-factor authentication and maintain persistent access to victim accounts. Microsoft has advised affected organizations to rotate any potentially compromised credentials, enforce multi-factor authentication, and monitor for suspicious account activity.

The operation marks a significant takedown of a phishing infrastructure-as-a-service model that lowered the barrier to entry for credential theft campaigns targeting enterprise and consumer Microsoft ecosystems. The full scope of data exfiltrated versus merely harvested remains under investigation.