EvilTokens

EvilTokens, a Telegram-sold subscription service charging $1,500 upfront and $500 monthly, abused Microsoft Entra device code authentication to compromise 12,000 accounts across 10,000 organizations. The service used an AI chatbot to analyze compromised emails and identify payment approval chains and impersonation tactics. Microsoft-led law enforcement operation seized 50 websites and 150 domains, with UK Met Police arresting two suspects.