Microsoft, along with law enforcement partners, just took down a cybercrime operation called EvilTokens. If you haven’t heard of it, that’s kind of the point. It wasn’t a flashy ransomware gang. It was more like a shadow IT provider, but for criminals. EvilTokens sold ready-made tools that let attackers steal login sessions and get around multi-factor authentication (MFA), the extra security step where you confirm your identity with a code, app prompt, or key beyond just a password.
Here’s why that matters. MFA has been the go-to advice for years. Turn it on, and you’re supposedly safe from most account takeovers. EvilTokens is a reminder that criminals adapted. Instead of trying to guess or steal passwords, these kits captured “tokens,” the digital proof that you already logged in successfully. Steal that token, and you can slip into someone’s account without ever needing their password or their MFA code. It’s called session hijacking, and it’s become a favorite shortcut for fraud rings targeting bank accounts, payment platforms, and business email systems.
Two people were arrested in the UK as part of this action, and Microsoft used legal and technical measures to disrupt the infrastructure behind the service. That’s notable because it treats cybercrime tooling like a business with a supply chain, and cuts off the supplier rather than chasing every individual customer using the kit.
For finance teams, this hits close to home. Account takeover fraud is already one of the costliest problems banks and payment companies deal with, and tools like this lower the skill needed to pull it off. Someone with almost no technical background could rent access to a kit that used to require real expertise.
Healthcare and government systems aren’t immune either. Both sectors rely heavily on remote access and cloud logins, and both hold data that’s valuable on criminal marketplaces. A stolen session token doesn’t care whether it’s opening a hospital records system or a benefits portal. It just needs a valid, logged-in session to exploit.
The bigger lesson is that MFA is necessary, but it’s not a finish line. Security teams increasingly need to watch for unusual session behavior, shorten how long tokens stay valid, and assume that determined attackers will find a way around any single control.
Worthy Questions
- Does this change how much trust organizations should place in MFA as a primary defense?
- Should tech companies have broader legal authority to disrupt cybercrime infrastructure before law enforcement gets involved?
- How should smaller banks or clinics without big security teams defend against tools this accessible?
- Will takedowns like this actually reduce fraud, or will a similar service just take EvilTokens’ place?