Microsoft seizes 50 EvilTokens phishing sites; UK arrests two suspects

September 22, 2026 at 08:00 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Microsoft and partners seized 50 websites and disabled over 150 domains tied to the EvilTokens phishing service, which compromised 12,000 email inboxes across 10,000 organizations. London's Metropolitan Police arrested two men, aged 32 and 38, on September 18 as suspected administrators. The action marks Microsoft's first disruption of an end-to-end AI-enabled cybercrime service.

Key Facts

EvilTokens compromised 12,000 email inboxes across more than 10,000 organizations worldwide.
Microsoft seized 50 websites and disabled more than 150 domains tied to EvilTokens infrastructure.
London's Metropolitan Police arrested two men, aged 32 and 38, on September 18 as suspected administrators.
About 1,000 cybercriminals used EvilTokens during its operation, according to a Microsoft spokesperson.
The disruption marks Microsoft Digital Crimes Unit's 40th court-authorized action and its first against an end-to-end AI-enabled cybercrime service.

The EvilTokens Platform

EvilTokens launched in February 2026 as a phishing-as-a-service sold over Telegram, designed to exploit Microsoft Outlook email accounts. The kit bypassed multi-factor authentication and allowed buyers to silently authenticate as victims to Microsoft 365 applications. An AI-powered analyst mapped trusted relationships, identified who controlled payments, and flagged where fraud was most likely to succeed. Microsoft observed 10 to 15 distinct campaigns launching every 24 hours since March 15, 2026.

Law Enforcement Action

Acting on a federal court order from the U.S. District Court for the Eastern District of Virginia, Microsoft and partners seized 50 websites on September 15. London's Metropolitan Police arrested two men, aged 32 and 38, on September 18 as suspected administrators of EvilTokens. Both suspects have been released on bail while the investigation continues. Microsoft worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs to take down the platform.

Impact and Significance

Healthcare organizations were among those targeted, prompting Health-ISAC to join Microsoft's legal action as a co-plaintiff. The AI condensed work that could otherwise take hackers several days into hours, helping them determine who controlled money and whom to impersonate. This action marks the Microsoft Digital Crimes Unit's 40th court-authorized disruption over nearly two decades. Steven Masada, associate general counsel and DCU general manager, called it the unit's first action against an end-to-end AI-enabled cybercrime service.