On September 22, 2026, Microsoft and a coalition of technology partners dismantled EvilTokens, an AI-powered phishing service that had compromised more than 12,000 Microsoft 365 inboxes across 10,000 organizations worldwide. Canada was among the countries specifically named as a victim zone. If your organization uses Microsoft 365, this story concerns you directly.
How Device-Code Phishing Works
EvilTokens did not rely on elaborate technical exploits. It weaponized a technique called device-code phishing: a socially engineered attack that tricks an employee into authenticating a fake login request, handing the attacker a valid session token without ever stealing the employee’s password. This is precisely the kind of human-layer threat that building a security awareness program that actually changes behaviour is designed to defend against.
The service operated like a polished cybercrime subscription. The entry price was a $1,500 initiation fee and a $500 monthly subscription, advertised through a Telegram storefront. Once a subscriber had a foothold in a victim’s inbox, an AI-based chatbot scanned the mailbox history and crafted follow-on scams tailored to the victim’s own relationships and email patterns. One attacker with one subscription could target hundreds of organizations before any individual victim noticed anything was wrong.
A Threat That Was Already Accelerating
Between late 2025 and early 2026, use of device-code phishing surged 1,380 per cent, according to Microsoft’s Digital Crimes Unit. EvilTokens was one of the primary engines behind that growth. The September 22 court action, authorized in the Eastern District of Virginia, stripped criminals of 50 websites and more than 150 domains. British police arrested two men on September 11 in connection with the service. But the method is now widely documented, and every criminal who paid for EvilTokens access already has the technique in hand.
The broader data reinforces what this case illustrates. Phishing, social engineering, and transfer fraud accounted for 85.3 per cent of incurred cyber losses in the first half of 2026, up from 17.7 per cent in the first half of 2024, according to Resilience’s mid-year cyber risk report. The human layer has become the primary attack surface, and it is outpacing the defences most organizations have deployed to protect it.
What Canadian Organizations Should Do Now
In our work with Canadian nonprofits, we consistently see organizations operating with security budgets a fraction of their commercial peers, while facing the same threat actors. The pattern in this story is one we encounter monthly: well-meaning staff, no formal training program, and a single click away from a crisis they cannot afford to recover from.
Device-code phishing is no longer a niche tactic. Three actions close most of the gap. First, train employees to treat any unexpected authentication prompt, even one that looks like a legitimate Microsoft dialog, as a red flag worth reporting to the security team immediately. Second, configure Conditional Access policies in Microsoft Entra to restrict device-code flow authentication to only the users who genuinely need it. Third, run a phishing simulation that includes a device-code scenario, so employees recognize the template before a real one arrives. For nonprofits and smaller Canadian organizations working with a constrained budget, POPP3R’s Security101 program offers structured security awareness training built for exactly this sector.
The EvilTokens takedown is a genuine win. But dismantling a service does not retire the technique. Every Canadian organization on Microsoft 365 is a potential target, and the cost of one compromised inbox, when an AI is mining it for follow-on attacks against your vendors, partners, and donors, is far higher than the cost of ensuring security awareness for Canadian organizations reaches every user on your team.
Sources
- Microsoft On the Issues: Disrupting EvilTokens (September 22, 2026)
- Help Net Security: Microsoft Disrupts EvilTokens Phishing Service (September 23, 2026)
- Axios: Microsoft and Partners Disrupt EvilTokens (September 22, 2026)
- CISO Series: Cybersecurity News, September 22, 2026
- PR Newswire: Resilience Claims Data Shows Human Error Drove Majority of Cyber Losses, H1 2026 (July 30, 2026)
