Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
5 / 5 results
highperson_alertThreat ActorMicrosoft Dismantles EvilTokens PhaaS Platform Linked to 12K Compromises
EvilTokens, tracked by Microsoft as Storm-2992, is a cybercrime operation that developed and operated a commercial phishing-as-a-service (PhaaS) platform.
highbug_reportVulnerabilityEvilTokens PhaaS platform disrupted after enabling 12,000+ inbox compromises
Organizations worldwide using Microsoft 365 and OAuth device code authentication. Over 12,000 inboxes compromised across 10,000+ organizations since February 2026.
highperson_alertThreat ActorEvilTokens PhaaS disrupted after 12,000 Microsoft account compromise
EvilTokens (tracked by Microsoft as Storm-2992) is a Phishing-as-a-Service (PhaaS) platform that emerged in February 2026. The operation was administered by two suspects, aged 32 and 38, arrested in the U.K.
highperson_alertThreat ActorEvilTokens Ghost Phishing Campaign Targets US and European Businesses
EvilTokens is a campaign leveraging "ghost phishing" techniques to target business entities across the United States and Europe. The campaign's primary motivation appears to be credential theft and unauthorized access to Microsoft 365 environments, w…
highperson_alertThreat ActorEvilTokens Affiliate ARToken Exposes M365 Phishing-as-a-Service Platform
EvilTokens is a threat actor operating a phishing-as-a-service (PhaaS) ecosystem targeting Microsoft 365 credentials. The group utilizes an affiliate model, with ARToken identified as one operational affiliate platform.