MediumII Cyber Warfare & Critical Infrastructure22 September 2026, Tuesday
Microsoft and London police dismantle AI-powered EvilTokens service that compromised 12,000 mailboxes at more than 10,000 organisations
On 22 September 2026 Microsoft announced that it had seized 50 websites belonging to EvilTokens, an AI-powered phishing and fraud service, and disabled more than 150 domains. The service is linked to the compromise of more than 12,000 mailboxes at over 10,000 organisations; London police arrested 2 people aged 32 and 38.
According to Microsoft's statement of 22 September, the operation was carried out with the authorisation of the US District Court for the Eastern District of Virginia, with Health-ISAC, the health sector's information-sharing organisation, as co-plaintiff. EvilTokens, which began operating in February 2026, was sold via Telegram for a 1,500-dollar entry fee and a 500-dollar monthly subscription. According to Microsoft, victims are concentrated mostly in the US, Canada, the UK, Australia, India and France; affected sectors include wholesale distribution, construction, financial services, real estate, higher education and healthcare. Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, the Shadowserver Foundation and TRM Labs supported the operation.
According to The Record, the service exploited weaknesses in the device code sign-in flow used by smart TVs, printers and conferencing devices to gain access to accounts without capturing passwords; its AI module summarised and translated compromised emails, highlighted financial correspondence and suggested potential targets. According to Microsoft, the Metropolitan Police's cybercrime unit arrested two men aged 32 and 38 on 11 September. This is the Microsoft Digital Crimes Unit's 40th court-authorised operation in about 20 years and its first against an end-to-end AI-powered cybercrime service.
The identities of those arrested, the charges they will face and the total financial losses of victims could not be verified as of 24 September.
Talay assessment
Bottom line
EvilTokens is the first major case showing AI automating the entire chain of cybercrime, from writing persuasive emails to analysing compromised accounts and selecting fraud targets. Although the seizure of 50 sites halted the service, the 500-dollar monthly subscription model suggests similar services can be rebuilt quickly. The most likely path is for similar services to return soon on new infrastructure.
Likely effects
- Corporate email securityNegativeWeeks
The use of the device code sign-in flow for passwordless access increases the need for organisations to restrict and monitor this flow.
- Cybercrime law enforcementPositive1–6 months
The combination of court authorisation, private-sector partners and British police offers a working model against cross-border cybercrime services.
- Organisations in TürkiyeNegative1–6 months
Turkish companies using Microsoft 365 are also exposed to device code phishing; although Türkiye is not named among victims, the same method can scale in any language via AI translation.
Possibilities, ranked
- 1Return on new infrastructure55%
The operators or imitators rebuild a similar AI-powered service with new domains.
Watch: Security firms' reports of new device code phishing campaigns
- 2Lasting blow30%
The arrests and seizures end the service, and further arrests and charges follow.
Watch: A charging announcement by the Metropolitan Police
- 3Wider breach wave emerges15%
Data obtained from the seized infrastructure reveals new victim organisations and large financial losses.
Watch: Victim notification updates from Health-ISAC and Microsoft
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Compromised mailboxes▼ 12,000+
- Websites seized▲ 50