C has joined Microsoft’ s Digital Crimes Unit( DCU), law enforcement agencies and industry partners in a coordinated global operation to disrupt EvilTokens, a phishing-as-a-service( PhaaS) platform designed to bypass multi-factor authentication( MFA) and facilitate Business Email Compromise( BEC) campaigns.
PHISHING
Cloudflare joins global operation to disrupt EvilTokens phishing platform
loudflare’ s threat intelligence team, Cloudforce One,
C has joined Microsoft’ s Digital Crimes Unit( DCU), law enforcement agencies and industry partners in a coordinated global operation to disrupt EvilTokens, a phishing-as-a-service( PhaaS) platform designed to bypass multi-factor authentication( MFA) and facilitate Business Email Compromise( BEC) campaigns.
MFA has become a fundamental security control for organisations, helping protect employees and corporate applications from stolen credentials. However, a new generation of PhaaS platforms is demonstrating how attackers are increasingly targeting authenticated sessions and tokens rather than passwords alone.
The operation combined legal and technical measures to dismantle infrastructure supporting EvilTokens. Microsoft initiated civil legal proceedings to seize control of domains associated with the platform, while Cloudforce One disrupted malicious infrastructure operating through Cloudflare, including blocking hundreds of domains and disabling malicious Cloudflare Worker projects.
EvilTokens first emerged on Telegram in January 2026, offering customers access to a web-based panel that automated the collection of authentication tokens used to access Microsoft 365 environments.
The platform was designed to enable persistent access even after session tokens expired, allowing attackers to maintain access to compromised accounts and potentially use them in subsequent attacks.
The service also incorporated an AI coach that provided guidance on topics including Business Email Compromise, US tax documents and typical invoice and accounting correspondence. This gave less experienced cybercriminals assistance in creating convincing phishing lures and impersonation scenarios.
Cloudflare’ s investigation found that EvilTokens users could provide their own Cloudflare API keys through the platform. These were then used to configure
Ercan Aydin, AVP, Middle East, Turkey & Africa at Cloudflare
Cloudflare Workers capable of collecting credentials and establishing phishing pages. Stolen credentials could subsequently be delivered to attackers through Telegram.
The operation highlights the growing professionalisation of cybercrime, where infrastructure, technical capabilities and guidance on social engineering techniques can be packaged and sold as a service.
While EvilTokens operated globally, the tactics used by the platform are particularly relevant to organisations across the Middle East and Africa, where Microsoft 365 and cloud-based collaboration platforms are widely used across government, financial services, professional services, healthcare, education and other sectors.
For regional organisations, the threat extends beyond the theft of usernames and passwords. A compromised corporate mailbox can provide attackers with access to legitimate conversations, contacts, invoices and business processes, potentially enabling highly convincing fraud attempts.
The use of stolen authentication tokens is also significant because attackers can attempt to exploit an already authenticated session, potentially circumventing security controls that rely primarily on users completing an MFA challenge.
“ For organisations across the Middle East and Africa, the incident provides a broader reminder that cybercriminals are adopting the same automation and AI technologies that businesses use to improve productivity, but applying them to scale fraud and credential theft. As phishing-as-a-service continues to lower the technical barrier for attackers, collaboration between cloud providers, security teams, threat intelligence organisations, technology companies and law enforcement will be increasingly important to identify and disrupt criminal infrastructure before it can cause further harm,” said Ercan Aydin, AVP, Middle East, Turkey & Africa at Cloudflare.
WWW. INTELLIGENTCISO. COM / MIDDLE-EAST 31