Threat actor
EvilTokens
Tracked by CyberSIXT since Jul 7, 2026 · last activity Sep 23, 2026
Coverage timeline
-
Microsoft Disrupts AI Phishing Platform After 12,000 Accounts Compromisedwww.securityweek.com · Sep 23, 2026
-
Microsoft Disrupts EvilTokens Attack Platform Behind 12,000 Account Breachesarstechnica.com · Sep 22, 2026
-
Microsoft Dismantles EvilTokens Phishing Service After 12,000 Email Compromisesthehackernews.com · Sep 22, 2026
-
ARToken phishing kit targets M365 users via device codesecurityonline.info · Jul 7, 2026