Actor Profile

EvilTokens, tracked by Microsoft as Storm-2992, is a cybercrime operation that developed and operated a commercial phishing-as-a-service (PhaaS) platform. The threat actors monetized a sophisticated device-code phishing service via Telegram since mid-February 2026, generating approximately $1.1 million in revenue between October 2025 and June 2026. Two individuals (aged 32 and 38) were arrested by the Metropolitan Police Service on September 11, 2026, in connection with the operation. The actors' motivation was financial gain through enabling business email compromise (BEC) and invoice fraud at scale by lowering technical barriers for affiliates. EvilTokens operated under a commercial model, charging one-time fees ($600-$1,500) plus monthly subscriptions ($500) for access to their platform, which integrated AI-driven mailbox analysis and fraud tooling into a turnkey solution.

TTPs (Tactics, Techniques, Procedures)

EvilTokens exploited OAuth 2.0 device authorization flow (device code phishing) to obtain authenticated sessions without credentials, corresponding to T1078 (Valid Accounts) and T1550.001 (Use Alternate Authentication Material: Application Access Token). Initial access was achieved via phishing emails (T1566) containing malicious URLs, PDF attachments, and HTML files with 44 different lure themes including invoices and RFPs. Post-compromise, actors established persistence through stolen access and refresh tokens (T1528 - Steal Application Access Token) and malicious inbox rules (T1137.005 - Office Application Startup: Outlook Rules) to conceal communications. The platform enabled email collection (T1114 - Email Collection) and credential access through token theft. AI-powered capabilities facilitated reconnaissance by analyzing victim inboxes to identify trusted relationships, payment authorizations, organizational roles, wire-transfer discussions, and optimal impersonation targets, supporting social engineering for BEC operations.

Targets & Patterns

EvilTokens primarily targeted organizations in the Technology, Finance, and Healthcare sectors within the United States, compromising approximately 12,000 inboxes. The targeting pattern reflects a focus on sectors with high-value financial transactions and sensitive data. The platform's AI-driven analysis specifically sought to identify "money movers," vendor invoices, wire-transfer discussions, and individuals with payment authorization responsibilities, indicating a clear focus on organizations vulnerable to BEC and invoice fraud schemes. The involvement of Health-ISAC in the takedown operation underscores the significant impact on healthcare organizations. The service attracted over 700 distinct cryptocurrency addresses making deposits, suggesting a broad customer base of cybercriminals seeking to conduct financial fraud operations. The platform's preset prompts for finding finance-related email threads and identifying trusted relationships demonstrate systematic targeting of business processes involving financial transactions across these sectors.

Historical Context

EvilTokens was first documented by Huntress in March 2026 as a PhaaS platform abusing OAuth 2.0 device authorization flows. Sekoia published detailed analysis in late March 2026, characterizing it as a turnkey solution sold on Telegram since mid-February 2026. A follow-up Sekoia report in April 2026 provided additional technical details on pricing and functionality. Coinbase's financial analysis traced platform revenue from October 2025 through June 2026, indicating the operation was active for at least eight months before the September 2026 takedown. The operation represents an evolution in PhaaS offerings by integrating AI capabilities throughout the attack chain—a novel approach that automated traditionally manual BEC workflows. The September 11, 2026 arrests and subsequent court-authorized takedown on September 22, 2026, involved unprecedented collaboration between Microsoft, Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs, reflecting the cross-industry impact of the platform.

Defensive Recommendations

  • Monitor and restrict OAuth 2.0 device code authorization flows by implementing conditional access policies that flag or block device code authentication attempts from unusual locations or unmanaged devices (T1078, T1550.001)
  • Deploy detection rules for suspicious inbox rule creation (T1137.005) via Microsoft 365 audit logs, particularly rules that forward, delete, or move messages to obscure folders—correlate with recent authentication events
  • Implement anomalous token usage detection by monitoring for access token requests following device code flows, especially when paired with immediate mailbox access or Graph API calls for email enumeration (T1528, T1114)
  • Conduct user awareness training focused on device code phishing tactics, emphasizing verification of unexpected device authorization prompts at legitimate URLs like microsoft.com/devicelogin, and establishing out-of-band verification procedures for financial requests
  • Enable multi-factor authentication with phishing-resistant methods (FIDO2, certificate-based) and enforce application consent policies to prevent unauthorized OAuth applications from accessing organizational resources

---

# Geopolitical Context

Geopolitical Context

The takedown of EvilTokens represents a significant public-private coordination effort in countering commercialized cybercrime infrastructure. Executed under U.S. court authorization from the Eastern District of Virginia, the operation demonstrates the increasing willingness of American judicial and corporate entities to pursue disruptive action against phishing-as-a-service (PhaaS) platforms that lower technical barriers to business email compromise (BEC) and financial fraud. The involvement of UK law enforcement—with two arrests by the Metropolitan Police Service in September 2026—suggests transatlantic coordination and potential attribution to actors operating within or connected to the United Kingdom. The integration of AI throughout the attack chain, including automated mailbox analysis and fraud strategy recommendation, marks an inflection point in the commoditization of advanced social engineering capabilities. This development may signal broader concerns among Western governments and technology firms about the dual-use risks of generative AI tools being repurposed for criminal enterprise at scale.

State Actor Alignment

No state-actor attribution is indicated in available reporting. Microsoft tracks the operators as Storm-2992, a designation that does not imply nation-state sponsorship. The arrests of two individuals aged 32 and 38 by UK Metropolitan Police on September 11, 2026, suggest the operation was commercially motivated cybercrime rather than state-directed activity. The platform's business model—charging $1,500 for lifetime access plus $500 monthly subscriptions, with approximately $1.1 million in revenue traced across cryptocurrency addresses between October 2025 and June 2026—is consistent with profit-driven criminal entrepreneurship. The multi-stakeholder takedown coalition, including U.S. private sector entities (Microsoft, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud), a sector-specific ISAC (Health-ISAC), non-profits (Shadowserver Foundation), and blockchain intelligence firms (TRM Labs), reflects a counter-cybercrime model focused on infrastructure disruption rather than geopolitical deterrence.

Business Impacty pro region

The EvilTokens disruption has implications for transatlantic cybercrime enforcement cooperation and the technology sector's role in countering commercialized attack platforms. The U.S. court-authorized action combined with UK arrests demonstrates operational coordination between American and British law enforcement, likely facilitated through existing mutual legal assistance frameworks. For European organizations—particularly in finance, healthcare, and technology sectors targeted by the platform—the takedown may provide temporary relief, though the commoditized nature of device-code phishing techniques suggests successor services may emerge. The involvement of Health-ISAC underscores ongoing vulnerabilities in the healthcare sector, which remains a priority target for BEC and ransomware actors. Globally, the case highlights cryptocurrency's continued role in cybercrime monetization, with Coinbase identifying over 700 distinct addresses making deposits to EvilTokens. The platform's use of Telegram for customer acquisition and support reflects the persistent challenge of encrypted messaging services as enablers of illicit commerce, a concern for European regulators advancing platform accountability measures under the Digital Services Act.

Forecast

If successor PhaaS platforms emerge offering similar AI-augmented capabilities, organizations in finance, healthcare, and technology sectors are likely to face continued elevated risk from device-code phishing and BEC campaigns, particularly if technical barriers to entry remain low. Should law enforcement agencies sustain coordinated disruption efforts against commercialized cybercrime infrastructure, the operational lifespan and profitability of such platforms may decrease, potentially deterring some criminal entrepreneurs. If generative AI providers implement more robust abuse detection and access controls, the integration of AI into automated fraud workflows may become more difficult, though determined actors are likely to develop workarounds or self-hosted alternatives. The involvement of cryptocurrency intelligence firms in this takedown suggests that blockchain tracing may increasingly constrain monetization pathways for PhaaS operators, potentially driving migration toward privacy-focused cryptocurrencies or alternative payment rails. Organizations should anticipate that device-code phishing techniques will persist and may be adopted by other threat actors, necessitating enhanced user education around OAuth authorization flows and conditional access policies that restrict device enrollment.