Microsoft Shuts Down Ai-driven Phishing Tool Affecting 12,000 Users

WHO:

TechRadar - Microsoft is the organization involved in shutting down the AI-driven phishing tool.

Ars Technica - EvilTokens is the group that provided the AI-assisted platform.

WHAT:

TechRadar - Microsoft took down an AI-boosted phishing tool that affected 12,000 accounts.

Ars Technica - The platform provided by EvilTokens made mass compromises faster and easier.

WHERE:

TechRadar - The operation against EvilTokens involved the seizure of dozens of websites, though specific locations are not detailed.

WHEN:

TechRadar - The operation against EvilTokens is described as organized, but no specific date is provided for when it occurred.

WHY:

Ars Technica - The disruption of the AI-assisted platform was likely aimed at preventing mass compromises of user accounts.

HOW:

Ars Technica - EvilTokens provided an end-to-end platform that facilitated the phishing attacks.

(UPDATED September 23, 2026 17:01 UTC)

Microsoft has successfully shut down an AI-driven phishing tool that compromised 12,000 accounts, with the operation targeting the group EvilTokens, which provided the platform that made these mass compromises easier. The action involved the seizure of dozens of websites, although specific locations have not been disclosed. This disruption aims to prevent further mass compromises of user accounts by dismantling the end-to-end platform used for these phishing attacks.