Microsoft and UK police have shut down EvilTokens, a criminal service used to take over more than 12,000 Microsoft 365 mailboxes. It didn’t steal passwords. It tricked people into typing a short code into a genuine Microsoft sign-in page, which handed their account to the criminals.
What’s happened
On 22 September Microsoft announced it had disrupted EvilTokens, a phishing service that criminals paid to use. Microsoft says it was used to break into more than 12,000 email accounts at over 10,000 organisations, with the UK among the countries hit hardest. Microsoft seized 50 websites and disabled more than 150 domains linked to it.
The Metropolitan Police’s cybercrime team arrested two men, aged 32 and 38, earlier in September on suspicion of fraud and money laundering offences. Both have been released on bail while the investigation continues.
The emails looked like everyday business messages: documents to sign, invoices, shared files, voicemails and “your password is expiring” notices, in 44 different designs. The link led to a page showing a short code and asking the reader to enter it at microsoft.com/devicelogin. That page is real. Microsoft uses it to sign in devices such as meeting-room screens. Entering the code signed the criminals in to the victim’s account instead.
Because the person signs in on a genuine Microsoft page and approves it themselves, a strong password and the usual multi-factor prompt don’t protect them. Once inside, an AI tool built into the service read through the mailbox, picked out conversations about payments, worked out who does what in the business and suggested who to impersonate.
What it means for your business
This is invoice fraud with a new way in. A criminal with access to a mailbox can watch real conversations with suppliers and customers, then send a convincing “our bank details have changed” email at exactly the right moment, from an address your contacts already trust.
EvilTokens itself has been disrupted, but the technique is well known and other criminals will keep using it. Small businesses are attractive targets because payments are often approved by one or two people over email.
What to do now
- Share one rule with your team: only type a code into a Microsoft page if you started the sign-in yourself, on a device in front of you. A code that arrives in an email or on a web page is a red flag.
- Block “device code” sign-in in Microsoft 365 unless you genuinely need it. Microsoft recommends this as the main protection. It’s a Conditional Access setting, with exceptions only for things like Teams meeting-room devices.
- Check payment changes by phone. Confirm any new bank details or unusual payment request by calling the person on a number you already have, never one from the email.
- Watch for new inbox rules. Criminals often add rules that forward or hide emails. Alerts for new rules help you spot a break-in early.
- If someone has entered a code, sign them out of all sessions, reset their password and check their mailbox rules straight away.
Sources
- Microsoft On the Issues: Disrupting EvilTokens (22 September 2026)
- Microsoft Security blog: Unmasking EvilTokens and device code phishing (22 September 2026)
- The Record: Two arrested in UK after Microsoft takedown of EvilTokens (22 September 2026)
Details are correct at the time of writing. Check the sources above for any later changes.
Want us to check this for your business? Call 01787 209 003, see our cyber security service, or book a free IT consultation.