Executive Summary
Microsoft and international law enforcement recently disrupted EvilTokens, a sophisticated Phishing-as-a-Service (PhaaS) platform developed by the threat actor Storm-2992. Emerging in February 2026, the service facilitated the compromise of over 12,000 inboxes across 10,000 organizations. The platform uniquely combined AI-powered mailbox analysis and automated lure generation with the abuse of the OAuth 2.0 device code flow, allowing attackers to bypass multi-factor authentication (MFA) without ever stealing traditional credentials.
Technically, the attack chain involves directing victims to a site that generates a legitimate Microsoft device code via background automation. The victim, believing they are performing a required security action, enters this code into the official Microsoft portal, thereby granting the adversary an authenticated session. Once access is achieved, the platform's AI tools identify high-value targets, analyze financial communications, and draft convincing impersonation emails for wire fraud.
This threat is significant due to its industrialization of credential-less account takeover. The disruption targeted 50 operation sites and 150 supporting domains. Despite this action, the emergence of 'vibe coded' toolkits and the reuse of high-reputation serverless infrastructure like Vercel and Cloudflare Workers for redirection indicate a persistent shift toward automated, AI-assisted identity attacks that traditional gateway defenses struggle to identify.