NewsHive
CONTACT USANALYST PORTAL →
securityBACKGROUND

EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts

BACKGROUND
3 SIGNALSFIRST DETECTED 22 September 2026
Narrative synthesis pending — 3 signals collected.
How the story developed
Other feeds and industry voices
22 Sept
Microsoft disrupts AI-assisted platform that compromised 12,000 accounts

EvilTokens provided an end-to-end platform that makes mass compromises faster and easier.

REPORT · WHAT · Ars TechnicaOPEN STORY
20 May
Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks

Microsoft on Tuesday said it disrupted a malware-signing-as-a-service (MSaaS) operation that weaponized the company's Artifact Signing system to deliver malicious code and conduct

REPORT · WHO · The Hacker NewsOPEN STORY
24 Jun
Amadey, StealC malware operations disrupted in Operation Endgame action

Microsoft, Europol, and international partners have disrupted infrastructure used by the Amadey and StealC malware operations as part of Operation Endgame, which targets

REPORT · WHAT · BleepingComputerOPEN STORY
5 May
Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries

Microsoft has disclosed details of a large-scale credential theft campaign that has leveraged a combination of code of conduct-themed lures and legitimate email services to direct

REPORT · WHAT · The Hacker NewsOPEN STORY
22 Jul
Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA

German and US law enforcement have taken down the core infrastructure of Kratos, described by German investigators as one of the world's most widely used criminal phishing kits,

REPORT · HOW · The Hacker NewsOPEN STORY
3 Jul
ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit

A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse into an

REPORT · WHAT · BleepingComputerOPEN STORY
7 Apr
Authorities disrupt router DNS hijacks used to steal Microsoft 365 logins

An international operation from law enforcement authorities in partnership with private companies has disrupted FrostArmada, an APT28 campaign hijacking local traffic from

REPORT · WHAT · BleepingComputerOPEN STORY
19 May
Cybercrime service disrupted for abusing Microsoft platform to sign malware

Microsoft says it has disrupted a malware-signing-as-a-service (MSaaS) operation that abused the company's Artifact Signing service to generate fraudulent code-signing

REPORT · WHO · BleepingComputerOPEN STORY
Sources
The Hacker News×2BleepingComputer

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →