EvilTokens Shows How AI Can Accelerate Microsoft 365 Account Attacks

EvilTokens illustrates a shift in cyberattacks: AI can help attackers make faster use of access they’ve already gained. That raises a practical question for security teams: how much can an intruder accomplish before detection leads to containment? The answer depends on more than the speed of an alert. It also depends on what the attacker can learn, who they can reach, and whether defenders can interrupt the sequence before it produces harm.

First identified in February 2026, EvilTokens is a phishing-as-a-service platform targeting Microsoft 365 accounts. It abuses OAuth 2.0’s device authorization grant flow, which can let attackers gain access without building a fake login page or collecting a victim’s password. Microsoft said in September, after taking down Storm-2992, the threat actor believed to be behind the operation, that EvilTokens used AI “at every step of the attack chain.” That description points to AI’s role across a process, rather than to a single automated trick.

AI turns account access into an attack plan

AI doesn’t remove the need for an initial foothold. It can, however, speed up what attackers do after entering an environment. EvilTokens analyzes business relationships and conversations to identify employees involved in payments, trusted contacts, and transactions that could be exploited. It can then suggest impersonation targets and draft fraudulent messages based on real business context. The value lies in connecting information that might otherwise take an operator time to find and interpret.

That progression spans the familiar stages of an attack: gaining access, expanding reach and establishing persistence, then pursuing an objective such as fraud, data theft or disruption. AI can increase an attacker’s speed, scale, sophistication and stamina—the “Four S’s,” as SimSpace describes them. EvilTokens packages some of those capabilities into a service attackers can buy. That matters because a service model can make techniques available to operators who might not have the time or skill to build them independently.

The distinction matters because the platform can guide an intruder through work that once demanded time and familiarity with the victim’s organization. A stolen account may become a starting point for targeted fraud before defenders have finished investigating the initial access. The account is still the entry point; the risk is how quickly it can be turned into a map of useful relationships and business activity.

This is more significant than it looks. The attack can draw on ordinary organizational context—who works with whom, and which transactions appear plausible—rather than relying only on generic lures. (And this is the part most people overlook.) A message that fits an existing business relationship may be harder for its recipient to question.

Response times need an outcome measure

Mean time to detect (MTTD) and mean time to respond (MTTR) remain useful measures, but their value depends on what an attacker can do during those intervals. A 30-minute detection window may carry a different cost when AI helps an intruder quickly identify people, processes and transactions to exploit. The same elapsed time can describe a contained investigation or the beginning of a credible fraud attempt.

Detection alone doesn’t stop the clock. If it isn’t followed by effective containment, the attacker may continue expanding access or preparing an attack. Teams should therefore assess whether they detect activity before it moves beyond the compromised account, and how much progress occurs before containment. An alert is a signal that work has begun; it isn’t evidence that the threat has been stopped.

The more useful measure of defensive speed is how quickly an attack can reach impact—and how much of its path security controls interrupt along the way. A strong detection time on paper says less if the attacker has already established persistence or identified a viable fraud target. What matters is the distance between initial access and meaningful consequence, and whether defenders can widen that distance.

Test the full route through the enterprise

Security products are often evaluated one at a time, while real attacks cross identity systems, email and network monitoring. An EvilTokens-style operation may encounter several controls, any of which could interrupt it. Individual product tests show how a tool handles a particular function; they don’t reveal how the defenses perform as a connected system. That gap can leave teams with confidence in separate components but little evidence about how they work together under pressure.

Recreating the full attack path gives teams a clearer picture. They can track when the first activity is detected, what the attacker achieves before and after that point, which controls block progress, and how long containment takes. Repeating those scenarios as threats and defenses change can show whether the gap between initial access and intervention is shrinking. It can also expose handoffs where an alert reaches one team but the next action depends on another system or decision.

If you're working in this space, the useful question is whether your exercises measure what an attacker can accomplish, not just whether a tool raises an alert. That said, no exercise can capture every possible route through an organization. Its value comes from testing plausible paths, recording where controls succeed or fail, and using those findings to improve the response.

The measure that matters is progress stopped

This approach aligns with preemptive security: identifying plausible attacker actions and fixing the weak points before an incident begins. EvilTokens is an early example of AI being applied to established criminal techniques. As similar tools make attacks faster and easier to scale, defenders will need to focus on limiting attacker progress before a live response becomes a race against the clock.

That shifts the evaluation from how quickly a team sees suspicious activity to how much of the attack it prevents from advancing. The distinction is practical: organizations need to know whether access can be contained before it supports impersonation, persistence or a larger operation. A useful measure, then, is not merely time to alert. It’s the progress an attacker makes before controls bring the activity to a halt.

Not just detection. Containment with consequences measured.