Microsoft Threat Intelligence publicly identified Storm-2992 on September 22, 2026 as the actor responsible for developing, operating, selling, and supporting the EvilTokens phishing-as-a-service platform. This is a newly disclosed Microsoft actor designation and therefore meets the watch criteria. Microsoft
| Field | Assessment |
|---|---|
| Actor | Storm-2992 |
| Aliases | None confirmed in public reporting |
| First observed | EvilTokens emerged February 2026 |
| Disclosure date | September 22, 2026 |
| Nexus | Cybercriminal; geographic nexus not publicly established |
| Motivation | Financial |
| Role | Developer/operator and support provider for EvilTokens PhaaS |
| Primary objective | Account takeover, token theft, BEC and financial fraud |
| Attribution confidence | Microsoft directly tracks the EvilTokens developer/operator as Storm-2992; no nation-state attribution is made |
Microsoft reports that EvilTokens has already facilitated compromise of more than 12,000 inboxes across over 10,000 organizations worldwide. Observed sectors include financial services, construction, wholesale distribution, real estate, higher education and healthcare, with the greatest concentrations in the United States, Canada, United Kingdom, Australia, India and France. Microsoft
Tooling and tradecraft
Storm-2992\\\'s principal platform is EvilTokens, an AI-enabled phishing-as-a-service system specifically designed to exploit OAuth device-code authentication rather than simply steal passwords.
The attack chain is notable because a victim ultimately authenticates through the legitimate Microsoft device-login infrastructure. EvilTokens initiates the authentication request, gives the victim the corresponding device code and continuously polls for successful authentication. Once the victim authorizes it, the attacker receives authenticated access without needing the victim\\\'s password. Microsoft
The platform incorporates:
- OAuth device-code phishing
- Authentication-token theft
- Automated token refresh
- Primary Refresh Token/device-registration persistence
- Microsoft Graph reconnaissance
- Automated organizational and permission mapping
- AI-assisted analysis of compromised mailboxes
- Automated identification of financial/executive targets
- Malicious inbox-rule creation
- Email exfiltration
- Internal and external phishing from compromised accounts
- Fake CAPTCHA/verification pages
- Multi-stage redirect infrastructure
- AI-generated target-specific phishing messages
Microsoft observed Storm-2992\\\'s ecosystem abusing Cloudflare Workers, Vercel and AWS Lambda as disposable or high-reputation redirect infrastructure, making simple domain blocklisting considerably less effective. Microsoft
The operator also sells EvilTokens through Telegram. Microsoft observed an initial price of $1,500, followed by a $500 monthly subscription, with additional tools such as Antibot redirectors, B2B Sender, Office 365 Capture Link and SMTP Sender sold separately.
Attribution assessment
Confirmed/high confidence: Microsoft Threat Intelligence explicitly tracks the actor responsible for development and support of EvilTokens as Storm-2992. EvilTokens has operated since February 2026, and Microsoft documented its sales/support infrastructure and observed campaigns. Microsoft
Not established: No credible public evidence in Microsoft\'s report establishes Storm-2992\'s nationality, physical location, government affiliation or relationship with a state intelligence service.
Important distinction: EvilTokens customers/affiliates conducting attacks should not automatically be attributed to Storm-2992. Microsoft\'s language specifically identifies Storm-2992 as the actor behind development and support of the service, while multiple cybercriminal customers use the platform to conduct campaigns.
