Microsoft obtained court authorization to disrupt EvilTokens, a service reportedly used for device-code phishing and Microsoft account compromise. The operation highlights how cybercrime services can enable attacks on corporate networks and financially motivated fraud.

Microsoft’s Digital Crimes Unit obtained court authorization to disrupt EvilTokens, a phishing service reportedly used to compromise Microsoft accounts through device-code phishing. According to the supplied report, the service enabled criminals to gain access to accounts and, in some cases, corporate networks. Such access can create opportunities for financially motivated attacks, including follow-on fraud. Device-code phishing abuses a legitimate sign-in flow: a victim can be tricked into entering a code supplied by an attacker, authorizing access without handing over a conventional password. The takedown targets infrastructure used to provide the cybercrime service, rather than serving as a warning that all device-code sign-ins are fraudulent. Users should treat unexpected requests to visit a sign-in page and enter a code with caution, and organizations should monitor unusual account access and promptly revoke suspicious sessions. The report describes a disruption authorized by a court; it does not specify in the supplied summary how many victims were affected or quantify financial losses. The case illustrates how phishing-as-a-service can scale account compromise and potentially facilitate downstream financial crime.