Microsoft disrupts EvilTokens PhaaS operation that compromised more than 12,000 Microsoft accounts

Microsoft’s Digital Crimes Unit led the disruption of the EvilTokens phishing-service infrastructure. The service compromised more than 12,000 inboxes across over 10,000 organizations worldwide and was used for sophisticated business email compromise (BEC) campaigns. Microsoft says the threat remains active, although attack volumes should decrease. Two men suspected of administering the EvilTokens website were arrested in the United Kingdom.