Microsoft Dismantles EvilTokens Phishing Network Targeting Enterprise SaaS Inboxes

Published: September 23, 2026 • Reading Time: 6 min read • Reporting: Intelligence Division

Microsoft has successfully disrupted EvilTokens, an AI-powered phishing-as-a-service platform responsible for breaching over 12,000 enterprise cloud accounts. The court-authorized action highlights a growing battle over identity security in B2B SaaS ecosystems.

Microsoft announced a coordinated takedown of the EvilTokens phishing-as-a-service (PaaS) platform, utilizing authorization from a U.S. District Court. The service exploited device-code authentication flows—a mechanism increasingly used in modern enterprise SaaS identity management—to bypass multi-factor authentication (MFA) and gain unauthorized access to corporate inboxes. According to Microsoft, the threat actors leveraged artificial intelligence at every stage of the attack chain, from generating highly convincing phishing templates to automating post-compromise inbox activities. By targeting the fundamental trust mechanisms of B2B cloud environments, EvilTokens managed to breach approximately 12,000 enterprise accounts before the legal and technical intervention.