Microsoft, Coinbase and law enforcement took down EvilTokens, a phishing kit that compromised 12,000 inboxes through device-code phishing and AI.

EvilTokens showed up in February 2026 and moved fast. Within months it had compromised more than 12,000 inboxes across over 10,000 organizations.

Microsoft says the EvilTokens platform, operated by Storm-2992, is a phishing-as-a-service kit sold to cybercriminals through Telegram. The service costs $1,500 upfront and $500 per month, with additional tools available for extra fees. Its control panel lets customers build and manage phishing campaigns, customize landing pages, configure domains, track victims, and manage stolen authentication tokens.

The platform includes 44 themes and uses AI to create targeted phishing emails based on a victim’s role. Lures can impersonate Microsoft services, document signing platforms, cloud providers, payment systems, and other business services.

What made EvilTokens different wasn’t the phishing itself, it was the AI wrapped around it. Once a mailbox was open, an AI assistant sifted through the contents, mapped who controlled payments, and flagged the accounts worth targeting. A task that used to take a skilled operator hours now took the platform seconds, which meant far less skilled criminals could run campaigns that used to require real expertise.

“Post-compromise, EvilTokens enabled threat actors to utilize AI assistants to sift through victim mailbox activity and engineer a phishing message based on the accessible email content. EvilTokens also allowed threat actors to conduct Microsoft Graph reconnaissance to map organizational structure and permissions, enabling continued access and potential lateral movement while tokens remain valid.” reads the report published by Microsoft. “While token-targeting phishing is not new, it has become far more common and industrialized over the last several years as organizations adopted multifactor authentication (MFA).”

The technique at the core of it is called device code phishing, and it’s worth understanding because it doesn’t touch your password at all. Device code sign-in exists for things like smart TVs and conference room devices that can’t handle a normal login screen. You get a short code on the device, then type it into a browser somewhere else to finish signing in.

“Device code phishing occurs when threat actors insert themselves into this process. Instead of a legitimate device requesting access, the threat actor initiates the flow and provides the user with a code through a phishing lure.” states Micorsoft. “When the user enters the code, they unknowingly authorize the threat actor’s session, granting access to the account without exposing credentials.”

That gap between devices is exactly what gets abused. A fake email, styled as an invoice or a DocuSign request, sends the victim to a page that’s quietly requested a real Microsoft device code behind the scenes. The victim sees the code, gets told to enter it on Microsoft’s actual login page to “verify their identity,” and does exactly that.

Below is the description provided by Coinbase of the attack on Microsoft’s device code login flow:

• The attacker’s access tokens survived password resets. Attackers registered devices in Entra ID for persistent access, created hidden inbox rules to suppress alerts and delete evidence, then impersonated finance staff, vendors, or executives inside live payment threads to redirect payments, including cryptocurrency.
• Victims received convincing, AI-generated emails styled as invoices, shared documents, or voicemail notifications, with malicious links embedded.
• The links led to fake Microsoft or DocuSign pages displaying a code and instructing victims to enter it on Microsoft’s real website to “verify their identity.” Doing so authorized the attacker’s session. Because authentication happened on Microsoft’s legitimate infrastructure, MFA was bypassed entirely.

The victim’s own MFA never gets a chance to fire, because the attacker’s session is the one that gets approved, not theirs. No password stolen, no suspicious login flagged, just a normal-looking authentication that happened to authorize the wrong person.

From there the kit did the boring but effective part. Attackers registered new devices to keep access alive past a password reset, built hidden inbox rules to bury their tracks, and then slid into ongoing email threads to redirect payments, sometimes in cryptocurrency, sometimes straight to a bank account.

Taking it down needed more than one company. Microsoft’s Digital Crimes Unit led the legal side, seizing 50 websites and disabling over 175 domains tied to the operation. Coinbase, Cloudflare, Health-ISAC, OpenAI, Railway, SpyCloud, and Shadowserver all contributed pieces, and the mix says something about how these takedowns actually work now: it’s rarely just the software vendor.

Coinbase’s part is the one worth lingering on, because it’s the least obvious. EvilTokens sold its kits for crypto and moved the proceeds through the Tron blockchain, so Coinbase’s Global Intelligence team followed the money instead of the malware. They traced roughly $1.1 million in revenue across four addresses, found over 1,000 deposits from more than 700 separate wallets, and mapped the full path from payment to cash-out.

That money trail is what led to a name, and the name led to an arrest. On September 11, London’s Metropolitan Police picked up the operator, seizing devices and evidence for examination. One detail from the investigation lands somewhere between alarming and funny: parts of the platform itself were reportedly “vibe coded,” meaning the criminals used AI to help build their own criminal tooling. The irony writes itself.

For anyone defending a network against this, the practical response comes down to a few habits worth making automatic. Treat any device code you didn’t request yourself as an immediate red flag, since no legitimate service asks you to “verify” anything by entering a code it sent you. Verify payment changes through a phone call to a known number, not through the email thread where the request showed up, and push toward passkeys or hardware keys wherever the option exists.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, phishing)

Japan ‘s Digital Agency disclosed a VPN breach exposing 246,000 government employee records across 23 ministries. Detected June 25, publicly disclosed September 11.

Japan ‘s Digital Agency disclosed that attackers exploited a vulnerability in a VPN device to access its Government Solution Service (GSS), potentially leaking personal information belonging to approximately 246,000 government employees, public officials, and contractors. The breach was detected on June 25 and confirmed as a VPN exploitation on July 9, meaning the public disclosure came 78 days after the initial detection and 63 days after the intrusion method was identified.

“It has come to our attention that, due to unauthorized external access, some files containing personal information handled on the Government Solution Service (GSS), operated by the Digital Agency, may have been leaked to an external party.” reads the advisory. “We have confirmed that the personal information that may have been leaked pertains to employees of various ministries and agencies that use GSS (hereinafter referred to as “GSS user organizations”) and those involved in their work, and does not include personal information of the general public.”

GSS connects 23 Japanese ministries and agencies through shared IT infrastructure. A breach of this platform could potentially affect many government organizations at once.

The attack followed a straightforward path. An outsider exploited a vulnerability in a VPN device that serves the GSS network, accessed the system using a maintenance and operations staff member’s account, and browsed a large number of files on the server. The agency detected the unusual activity on June 25, confirmed the VPN exploitation on July 9, then suspended the maintenance account and cut off external communications from the compromised hardware the same day. A subsequent investigation with external security specialists confirmed that files containing personal information may have been exfiltrated.

“On June 25, 2026, we detected that a large number of files on the server had been accessed using the account of a maintenance and operations staff member, and we began an investigation. On July 9, it was discovered that a third party had exploited a vulnerability in the network connection device (VPN) to infiltrate the system and gain unauthorized access. On the same day, we suspended the maintenance and operations staff member’s account and cut off communication between the compromised equipment and the outside world to prevent further unauthorized access.” continues the report.”As a result of our investigation with the cooperation of an external expert company, we have confirmed that there is a possibility that personal information may have been leaked to an external party.”

The potentially exposed data breaks down to roughly 236,000 names, 231,000 email addresses, 94,000 phone numbers, and approximately 1,000 physical addresses. Of the 246,000 total records, about 189,000 belong to employees of GSS-using organizations and public officials involved in their work, including staff at independent administrative agencies. The remaining 57,000 records relate to businesses and individuals contracted to support those organizations. The data doesn’t include My Number identification numbers, financial institution account numbers, or pension numbers.

The VPN flaw was rated medium severity and wasn’t a zero-day. A patch was already available when attackers exploited it, but the agency hasn’t revealed the VPN product or the flaw.

Japan’s privacy regulator was notified on July 15, six days after the attack was confirmed. The Digital Agency said the delay came from the difficulty of tracing the attack, assessing the affected data, and identifying those involved.

The incident also shows the risk of leaving a known, patchable flaw unaddressed on infrastructure shared by 23 ministries.

No confirmed misuse of the exposed data has been reported. However, the leaked names, email addresses and phone numbers could enable targeted phishing and social engineering, including scams impersonating Japan’s Digital Agency. The agency will contact affected people directly and warns that it will never request passwords or payments by email or phone.

The breach is one in a series of significant cybersecurity incidents affecting Japanese institutions. NISC, Japan’s National Cyber Incident Readiness and Strategy Center, disclosed a breach in 2023 that affected its email system. Japan Aerospace Exploration Agency (JAXA) reported unauthorized access to its systems in 2024. The pattern points to systemic challenges in patching and access management across Japan’s public sector infrastructure rather than isolated failures.

The Digital Agency’s planned remediation includes improved vulnerability management and changes to external connection methods, which are the right responses to the immediate incident. Whether they address the underlying governance question is harder to assess from the public advisory alone.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)