Microsoft dismantles AI-powered phishing service EvilTokens linked to 12,000 compromised inboxes

Sources agree on the core facts: EvilTokens operated via Telegram from mid-February 2026, offered subscriptions from $600 to $1,500 with add-ons, and was tracked by Microsoft as Storm-2992. Coinbase traced approximately $1.1 million in revenue across four Tron addresses between October 2025 and June 2026 from over 700 distinct crypto addresses. Microsoft seized 50 websites and disabled over 150 domains. The takedown followed a U.S. District Court order for the Eastern District of Virginia.

Only The Hacker News details the three specific EvilTokens products: B2B sender ($600), Office 365 capture link ($1,500), and SMTP sender ($1,000), with the latter two requiring ongoing fees. Only CryptoSlate notes investigators found evidence of AI-assisted coding tools used in building parts of EvilTokens. Only CSO Online includes expert commentary from Omair Manzoor of ioSENTRIX on infrastructure mistakes and future threats.