Threat+Constellation
Live— UTC
← Incidents
INCIDENT 638PhishingLOW / UNDER REVIEWSourced

Unmasking EvilTokens: Getting to the root of device code phishing

EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption of EvilTokens infrastructure and operations. The post Unmasking EvilTokens: Getting to the root of device code phishing appeared first on Microsoft Security Blog .

Last evidence update
22 SEP 2026 · 15:00 UTC
Source count
1
Status
reported
Observation history

How this record has evolved as evidence accumulated.

23 SEP · 05:22 UTC
Initial report
Evidence