EvilTokens infrastructure targeted in reported legal seizure
SecurityUnverifiedUpdated:
Infrastructure linked to EvilTokens, a platform associated with more than 12,000 compromised Microsoft accounts, was reportedly seized. The service remains active, however, and copies have appeared.
The service and copies continue after infrastructure seizure
BleepingComputer reports that Microsoft’s Digital Crimes Unit coordinated an action with partners and law enforcement to seize active infrastructure associated with EvilTokens, a phishing-as-a-service (PhaaS) platform. The article says two suspected site administrators were arrested in the U.K. and released on bail pending further investigation. It also says the action was not a full takedown: EvilTokens remains active and clones, including APToken, have appeared.
EvilTokens was operating as a phishing-as-a-service platform, offering device-code phishing capabilities and related tools to affiliates.
According to the report, legal authority was used to seize active EvilTokens infrastructure, disrupting the service. The operation reportedly remains active, and affiliates have already created clones.
The reported action marks a shift from an operating phishing service to one facing infrastructure seizure, while illustrating that disruption of a service does not necessarily remove the broader device-code-phishing capability or its copies.
Sources
- BleepingComputerEvilTokens PhaaS disrupted after compromising 12,000 Microsoft accountsRead source →