{
  "id": 9160235,
  "title": "UK cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites",
  "url": "https://urgent.news/2026/09/22/uk-cops-arrest-2-eviltokens-suspects-microsoft-seizes-50-phishing-kit-9160235",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-22T15:00:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/09/22/uk-cops-arrest-2-eviltokens-suspects-microsoft-seizes-50-phishing-kit-websites/5298317"
  },
  "original_language": "en",
  "account": "UK law enforcement and Microsoft have taken significant action against the EvilTokens phishing service. The coalition led by Microsoft has arrested two men suspected of being website administrators and seized over 50 websites used to operate the service. EvilTokens, a notorious Microsoft device-code phishing kit, has been used to compromise email accounts of 12,000 individuals across more than 10,000 organizations worldwide. This particular phishing subscription was especially insidious due to its use of AI technology. The AI chatbot could analyze victims' inboxes, helping criminals identify targets, trusted contacts, and even the most effective fraud strategies. Microsoft's Digital Crimes Unit (DCU) has conducted this action, making it their 40th court-authorized disruption in nearly two decades. The incident highlights the importance of strong identity protections and monitoring, as well as the need for organizations to independently verify requests for changes in payment information, fund redirections, or approvals of unusual transactions through a trusted second channel.",
  "summary": "Used by crims to compromise 12K+ email inboxes across 10K+ global orgs",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}