Microsoft's Digital Crimes Unit, acting with court authorization, disrupted EvilTokens, a phishing-as-a-service platform that compromised more than 12,000 Microsoft accounts at over 10,000 organizations. The operation also resulted in the arrest of two suspects in the UK, according to all four sources.
The sources agree on the scale of the compromise and the takedown, but they differ in emphasis. The Hacker News reports that Microsoft said the service used AI throughout the attack chain, while Recorded Future News notes that EvilTokens was sold on Telegram for a $1,500 initiation fee and a $500 monthly subscription. BleepingComputer describes the platform as PhaaS, and The Register adds that 50 phishing kit websites were seized.
The arrests and website seizures suggest the operation targeted both the operators and the infrastructure. The service was designed to help cybercriminals compromise accounts, analyze breached inboxes, and identify ways to monetize access, according to Recorded Future News.