Cloudflare, with Microsoft and other entities, disrupted EvilTokens, a major phishing-as-a-service (PhaaS) platform. EvilTokens specialized in bypassing multi-factor authentication on Microsoft 365 accounts. This led to the compromise of over 12,000 email inboxes across more than 10,000 organizations globally.
EvilTokens utilized AI-powered tools to analyze compromised inboxes, identify valuable targets, and craft sophisticated business email compromise (BEC) attacks. The platform sold subscriptions on Telegram. It also abused Cloudflare's Workers infrastructure to host malicious logic for its phishing campaigns.
As part of the coordinated takedown, Cloudflare's threat research team executed a technical purge of the infrastructure. This included banning associated domains and Workers projects. Microsoft initiated a legal process to seize domains used by the cybercrime operation. Cloudflare synchronized its actions with this legal process.