conv.

← The whole story
Security
Microsoft dismantles EvilTokens, an AI-driven phishing platform, two men arrested

Researchers detail device-code OAuth abuse behind the scheme

2 Sep 22 · 1d ago · 6 articles · 2 posts · 3 sources · development 2 of 2

Microsoft and security firm SpyCloud described how EvilTokens automated spam emails that led victims to pages running hidden scripts to generate device authentication codes via Microsoft Entra, letting attackers enroll their own devices and evade signature-based detection.

Researchers detail device-code OAuth abuse behind the scheme
arstechnica.com

“While EvilTokens helped cybercriminals access email accounts, at the center of the service was an AI-style chatbot that could analyze a victim's inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other circumstances where fraud was most likely to succeed.”

Microsoft, Company statement · mastodon ↗

Microsoft Investigating companySpyCloud Security firmUK Metropolitan Police Service Law enforcementDan Goodin Ars Technica security reporter

The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump

Peak 8 pieces in one hour at Sep 22, 3 PM; 17 pieces over 38 hours (7 articles · 10 posts) Sep 22, 11 AM — 1 piece · 1 post — Mastodon 1Sep 22, 12 PM — quietSep 22, 1 PM — quietSep 22, 2 PM — quietSep 22, 3 PM — 8 pieces · 6 articles · 2 posts — Google News 4, Mastodon 3, Newswires 1Sep 22, 4 PM — 1 piece · 1 article — Newswires 1Sep 22, 5 PM — quietSep 22, 6 PM — quietSep 22, 7 PM — 1 piece · 1 post — Mastodon 1Sep 22, 8 PM — quietSep 22, 9 PM — quietSep 22, 10 PM — quietSep 22, 11 PM — quietYesterday, 12 AM — 1 piece · 1 post — Mastodon 1Yesterday, 1 AM — quietYesterday, 2 AM — quietYesterday, 3 AM — 2 pieces · 2 posts — Bluesky 1, Hacker News 1Yesterday, 4 AM — quietYesterday, 5 AM — quietYesterday, 6 AM — quietYesterday, 7 AM — 2 pieces · 2 posts — Bluesky 1, Mastodon 1Yesterday, 8 AM — quietYesterday, 9 AM — quietYesterday, 10 AM — 1 piece · 1 post — Mastodon 1Yesterday, 11 AM — quietYesterday, 12 PM — quietYesterday, 1 PM — quietYesterday, 2 PM — quietYesterday, 3 PM — quietYesterday, 4 PM — quietYesterday, 5 PM — quietYesterday, 6 PM — quietYesterday, 7 PM — quietYesterday, 8 PM — quietYesterday, 9 PM — quietYesterday, 10 PM — quietYesterday, 11 PM — quietToday, 12 AM — quiet ◂ 1 earlier2
2Researchers detail device-code OAuth…
4 PMyesterday8 AM4 PMnow · 1:00 AM ET

Reported in the same hours no headline names this development itself — these 4 claims were published in its stretch

  1. 2 outlets Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises

    first by The Hacker News, 1d ago · also Dark Reading

    1 more headline
  2. 2 outlets Microsoft disrupts AI-assisted platform that compromised 12,000 accounts

    first by Mastodon, 1d ago · also Ars Technica

    1 more headline
  3. 1 outlet EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts

    first by BleepingComputer, 1d ago

  4. 1 outlet Microsoft's EvilTokens takedown sheds light on state of AI-powered cybercrime

    first by csoonline.com, 1d ago

What people said 1 voice · verbatim

All 2 developments of Microsoft dismantles EvilTokens, an AI-driven phishing… →

MastodonNewswiresGoogle NewsHacker NewsBluesky