Cloudforce One works with Microsoft and law enforcement partners to dismantle cybercrime infrastructure targeting Microsoft 365 users globally
DUBAI, UAE, September, 2026: Multi-factor authentication (MFA) has become a fundamental security control for organisations, helping protect employees and corporate applications from stolen credentials. But a new generation of phishing-as-a-service (PhaaS) platforms is demonstrating that attackers are increasingly targeting authenticated sessions and tokens rather than passwords alone.
Cloudflare’s threat intelligence team, Cloudforce One, has joined Microsoft’s Digital Crimes Unit (DCU) and law enforcement and industry partners in a coordinated global operation to disrupt EvilTokens, a PhaaS platform designed to bypass MFA and facilitate Business Email Compromise (BEC) campaigns.
The operation combined legal and technical action to dismantle infrastructure supporting the criminal service. Microsoft initiated civil legal proceedings to seize control of domains associated with EvilTokens, while Cloudforce One conducted a technical disruption of malicious infrastructure operating through Cloudflare, including blocking hundreds of domains and disabling malicious Cloudflare Worker projects.
Making sophisticated cybercrime accessible:
EvilTokens first emerged on Telegram in January 2026, offering criminal customers access to a web-based panel that automated the collection of authentication tokens used to access Microsoft Office 365 environments. The platform was designed to enable persistent access even after session tokens expired, allowing attackers to maintain access to compromised accounts and use them in subsequent attacks.
The service also incorporated an AI coach, providing guidance on subjects including Business Email Compromise, U.S. tax documents and typical invoice and accounting correspondence. This effectively gave less experienced cybercriminals assistance in creating convincing phishing lures and impersonation scenarios.
Cloudflare’s investigation found that EvilTokens users could provide their own Cloudflare API keys through the criminal panel. These keys were then used to configure Cloudflare Workers capable of collecting credentials and establishing phishing pages. Stolen credentials could subsequently be delivered to attackers through Telegram.
The operation highlights the growing professionalisation of cybercrime, where infrastructure, technical capabilities and even guidance on social engineering techniques can be packaged and sold as a service.
A global threat with regional implications:
While EvilTokens operated globally, the tactics used by the platform are particularly relevant to organisations in the Middle East and Africa, where Microsoft 365 and cloud-based collaboration platforms are widely used across government, financial services, professional services, healthcare, education and other sectors.
For regional organisations, the threat extends beyond the theft of usernames and passwords. A compromised corporate mailbox can provide attackers with access to legitimate conversations, contacts, invoices and business processes, potentially enabling highly convincing fraud attempts.
The use of stolen authentication tokens is also significant because it demonstrates how attackers can attempt to exploit an already authenticated session, potentially circumventing security controls that rely primarily on the user completing an MFA challenge.
Coordinated disruption targets the infrastructure behind the attacks:
On September 15, Cloudforce One joined Microsoft in a multi-partner operation targeting EvilTokens across both legal and technical fronts. Microsoft identified and analysed domains associated with attacks against its customers and shared intelligence with strategic partners, including Cloudflare. Cloudforce One used its threat intelligence and network visibility to identify the broader infrastructure associated with the operation.
Cloudflare subsequently conducted a technical sweep to remove malicious Workers projects and infrastructure supporting EvilTokens. The company blocked hundreds of domains, suspended associated accounts and developed detections designed to prevent the malicious Workers scripts from being redeployed.
Where domains could not be seized through legal action because of non-cooperating jurisdictions, Cloudflare deployed warning pages designed to prevent victims from reaching the phishing infrastructure.
MFA remains important, but organisations need layered protection:
The EvilTokens operation reinforces the need for organisations to look beyond passwords and traditional MFA as a single line of defence. Cloudflare recommends that organisations consider phishing-resistant authentication such as FIDO2, WebAuthn, hardware security keys and passkeys, alongside stronger conditional access controls. Organisations should also monitor session activity, apply appropriate session controls and use email and DNS security measures to identify and block malicious infrastructure.
Cloudflare also recommends strengthening email authentication through properly configured DMARC, SPF and DKIM, alongside technologies capable of detecting suspicious links, attachments and phishing campaigns.
“For organisations across the Middle East and Africa, the incident provides a broader reminder that cybercriminals are adopting the same automation and AI technologies that businesses use to improve productivity, but applying them to scale fraud and credential theft. As phishing-as-a-service continues to lower the technical barrier for attackers, collaboration between cloud providers, security teams, threat intelligence organisations, technology companies and law enforcement will be increasingly important to identify and disrupt criminal infrastructure before it can cause further harm,” said Ercan Aydin, AVP, Middle East, Turkey & Africa at Cloudflare.
Image attached
About Cloudflare:
Cloudflare, Inc. (www.cloudflare.com / @cloudflare) is on a mission to help build a better Internet. Cloudflare’s suite of products protect and accelerate any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare have all web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures 2018 list and ranked among the World’s Most Innovative Companies by Fast Company in 2019. Headquartered in San Francisco, CA, Cloudflare has offices in Austin, TX, Champaign, IL, New York, NY, San Jose, CA, Seattle, WA, Washington, D.C., Toronto, Lisbon, London, Munich, Paris, Beijing, Singapore, Sydney, and Tokyo.
