Microsoft and several partners took down EvilTokens on September 22, 2026, a subscription-based phishing service that compromised more than 12,000 inboxes. Its victims signed in on Microsoft's real page, approved their two-factor authentication, and opened the door to the attacker.
79 earlier articles below.