As cited
Copy frozen at (site build).
ransomware
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
Microsoft's Digital Crimes Unit disrupted the EvilTokens platform, which had compromised more than 12,000 Microsoft accounts across over 10,000 organizations. The takedown targeted a phishing-as-a-service operation that delivered credential theft at scale.
Why it matters: Organizations whose accounts were compromised in this campaign should assume credentials are in attacker hands and reset passwords, review sign-in logs for unauthorized activity, and enable multifactor authentication (MFA) if not already deployed.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
ransomware
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
Microsoft's Digital Crimes Unit disrupted the EvilTokens platform, which had compromised more than 12,000 Microsoft accounts across over 10,000 organizations. The takedown targeted a phishing-as-a-service operation that delivered credential theft at scale.
Why it matters: Organizations whose accounts were compromised in this campaign should assume credentials are in attacker hands and reset passwords, review sign-in logs for unauthorized activity, and enable multifactor authentication (MFA) if not already deployed.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
ransomware
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
Microsoft's Digital Crimes Unit disrupted the EvilTokens platform, which had compromised more than 12,000 Microsoft accounts across over 10,000 organizations. The takedown targeted a phishing-as-a-service operation that delivered credential theft at scale.
Why it matters: Organizations whose accounts were compromised in this campaign should assume credentials are in attacker hands and reset passwords, review sign-in logs for unauthorized activity, and enable multifactor authentication (MFA) if not already deployed.
- Source published
- First seen by Cybersecurity Tracker