Microsoft announced on September 22, 2026 that it disrupted EvilTokens, a cybercrime platform combining email account theft with AI-assisted fraud planning.
What changed
According to Microsoft, the service was linked to more than 12,000 compromised inboxes across over 10,000 organizations. Its AI tools could analyze messages, identify financial conversations, and suggest trusted contacts to impersonate.
Why it matters
Victims could be tricked into entering an authentication code on Microsoft’s legitimate sign-in page, giving criminals account access without revealing a password. Microsoft warns that access may survive a password reset unless associated sessions and tokens are revoked.
What deserves attention
- Do not enter a sign-in code supplied through an unexpected message.
- Verify payment changes through a trusted, separate contact method.
- If an account is compromised, ask IT to investigate and revoke unauthorized access, rather than relying on a password change alone.
Panther Note: our view
A convincing message can come from a real, compromised inbox. Familiar names and genuine sign-in pages are reasons to check the request’s context, not proof that it is safe.
Source: Microsoft’s EvilTokens disclosure, September 22, 2026.