24 days ago
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
What's happening
SignalsMonitor is following this as a security story. Ars Technica and BleepingComputer are the outlets attached to this story. The first report grouped here was at 22 Sept 2026, 15:00 UTC. 2 material updates are listed in the timeline. The headline in use is “EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts”. This note is SignalsMonitor's own briefing, not the publisher's article.
What we know
The EvilTokens platform that compromised more than 12,000 Microsoft accounts at over 10,000 organizations has been disrupted in an effort led by Microsoft's Digital Crimes Unit (DCU). [...
Story timeline
Reports grouped into this story, earliest first. Exact repeats from the same outlet are collapsed.
- First reported by BleepingComputer
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
- Picked up by Ars Technica
Microsoft disrupts AI-assisted platform that compromised 12,000 accounts
Same story, different outlets
2 headlinesEach line is that outlet's headline. The article stays on the publisher's site.