On Tuesday, Microsoft announced the takedown of EvilTokens, a phishing-as-a-service platform that used AI across its entire attack chain — from crafting lures to analysing compromised inboxes and surfacing the most lucrative fraud opportunities. Two suspects were arrested in the UK, 50 websites were seized, and more than 150 domains disabled, with court authorisation from a US federal court in Virginia.

EvilTokens wasn't a script-kiddie toolkit. It was a subscription business. Criminals paid a $1,500 initiation fee and $500 a month to access a Telegram-delivered service that specialised in device code phishing — a technique that tricks users into authorising attacker-controlled devices on their Microsoft 365 accounts. No password required; just a code that looks routine. The result: more than 12,000 compromised inboxes across 10,000-plus organisations globally.

The AI angle here is what sets this apart. According to Microsoft, the platform didn't just automate template generation — it used AI to analyse what was inside each breached inbox and recommend the best monetisation path. Think of it as a post-breach business analyst, running on stolen access. Health-ISAC, Cloudflare, Coinbase, OpenAI, and Shadowserver all contributed to the disruption effort, which is an unusually broad coalition even by takedown standards.

Device code phishing is worth understanding. The flow looks like this: attacker sends a message impersonating IT support or a trusted service, tells the target to enter a code at a legitimate Microsoft login page, and the target unwittingly grants the attacker a valid access token. Tokens persist after password resets. Multi-factor authentication, done the normal way, doesn't stop it. The attack exploits a legitimate authentication flow — not a bug — which is part of why it's so effective and so hard to block at the perimeter.

The broader significance isn't just one platform going dark. It's what EvilTokens represents: commodified, AI-assisted credential theft available to anyone with $500 a month and a Telegram account. The barrier to running a sophisticated phishing operation is collapsing. Defenders still need deep expertise to respond; attackers increasingly don't need it to attack.

For Australian organisations, the exposure here is direct. Microsoft 365 is the dominant productivity platform across Australian government, enterprise, and critical infrastructure. Device code phishing attacks don't respect geography, and the ACSC has previously flagged token-based authentication abuse as an active threat vector. Australian entities operating under the Security of Critical Infrastructure Act should treat this as a reminder to audit authentication flows, restrict device code grants where they're not operationally needed, and verify that conditional access policies are actually blocking high-risk sign-in patterns — not just flagging them.

The UK arrests are encouraging, but EvilTokens-style services are modular by design. Expect a successor. The code, the playbook, and the subscriber base don't disappear when a Telegram channel gets shut down.

What to watch: whether Microsoft publishes full indicators of compromise, and whether the arrested suspects have known links to broader cybercrime ecosystems. The Health-ISAC involvement also hints this platform was particularly active against healthcare targets — a sector already under sustained pressure.