Microsoft disrupts EvilTokens phishing service that hit 12,000 accounts

Microsoft and partners disrupted the EvilTokens phishing-as-a-service platform, which compromised over 12,000 Microsoft accounts at more than 10,000 organizations. Two suspected administrators were arrested in the U.K.; the service sold access for $500/month or a one-time $1,500 fee.

• EvilTokens compromised 12,000+ accounts across 10,000+ organizations
• Service sold for $500/month or a one-time $1,500 fee
• Two suspected admins arrested in the U.K., released on bail
• Attacks abuse device-code phishing to bypass MFA