> TritonInfoSec News
Home / Sep 24, 2026 / Story
0
#5 The Hacker News general September 22, 2026 at 17:03 UTC

Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises

By [email protected] (The Hacker News)

AI Summary

Microsoft, acting under a U.S. District Court for the Eastern District of Virginia authorization, seized 50 websites and disabled 150+ domains belonging to EvilTokens, an AI-powered phishing-as-a-service platform linked to 12,000 Microsoft 365 inbox compromises. EvilTokens used AI throughout the attack chain — for crafting social engineering lures, selecting targets, and conducting device code phishing. The takedown involved Health-ISAC, Cloudflare, Coinbase, OpenAI, and SpyCloud.

Read full article → https://thehackernews.com/2026/09/microsoft-takes-…

Relevance score: 86.0/100

# More from September 24

  1. 1
    F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers The Hacker News
  2. 2
    ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants The Hacker News
  3. 3
    Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks The Hacker News
  4. 4
    Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware The Hacker News
  5. 6
    MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key The Hacker News
  6. 7
    Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape The Hacker News
  7. 8
    Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers BleepingComputer
  8. 9
    Check Point warns of hackers exploiting Security Gateway VPN RCE flaw BleepingComputer
  9. 10
    Arista patches actively exploited VeloCloud Orchestrator zero-day BleepingComputer