EvilTokens Shows Why Security Teams Must Measure Attacker Progress

EvilTokens points to a shift in the economics of account compromise: once attackers gain access, AI can help them map an organization and act before defenders contain the intrusion. The security question is no longer only how quickly a team detects a threat. It’s how much an attacker can accomplish in that interval.

First identified in February 2026, EvilTokens is a phishing-as-a-service platform targeting Microsoft 365 accounts. It exploits OAuth 2.0’s device authorization grant flow, allowing attackers to access Microsoft accounts without building fake login pages or collecting victims’ passwords. After Microsoft took down Storm-2992, the threat actor believed to be behind the operation, in September, the company said EvilTokens used AI “at every step of the attack chain.”

That description captures the practical concern. AI doesn’t need to create a new way into an organization to change the threat. It can speed up the analysis and decisions that follow a successful breach, compressing the time defenders have to intervene.

AI speeds up what happens after access

Cyberattacks typically move through three broad phases: gaining access, expanding control and pursuing an objective. Attackers may steal credentials, exploit a vulnerability or persuade an employee to authorize access. Once inside, they can seek persistence and reach more systems or people before turning that position into fraud, data theft, ransomware or disruption.

At each stage, AI can increase an attacker’s speed, scale, sophistication and stamina—what SimSpace calls “The Four S’s.” EvilTokens bundles several of those advantages into a service. After using the device authorization flow to secure access, it can analyze business communications to identify who handles payments, which relationships rely on trust, and where invoices or transactions might be exploited.

That analysis can inform whom to impersonate and help draft fraudulent messages based on real conversations. As security experts have cautioned, multifactor authentication alone can’t stop every route to account takeover. In this case, the victim authorizes the attacker through a legitimate authentication flow rather than handing over a password.

Here’s the thing: the initial foothold still matters, but it’s only the beginning. Packaging AI-assisted analysis and recommendations in a criminal service reduces the effort needed to turn account access into a targeted attempt at fraud.

Response time needs context

Mean time to detect (MTTD) and mean time to respond (MTTR) remain useful measures, but AI-assisted attacks make their context more important. A 30-minute detection window may once have seemed acceptable; an attacker who can quickly identify valuable accounts, relationships and transactions may use that same window to make substantial progress.

Detection alone doesn’t stop the clock. If it doesn’t trigger prompt containment, an attacker can continue expanding access and preparing the next move. A team that detects activity before it spreads beyond the compromised account has limited the threat more effectively than one that detects it after persistence is established and targets are selected—even if both teams report similar detection times.

Security leaders should therefore assess speed against the attacker’s path to impact. How quickly can a threat move from initial access to fraud or disruption? What can it reach before containment? Those questions give MTTD and MTTR operational meaning.

Test the full attack path

Enterprise defenses are often evaluated one product or control at a time, while real attacks cross several systems. An EvilTokens-style operation might encounter email security, identity checks and network monitoring. Any of those layers could disrupt it, but isolated tests reveal little about how they work together as an attacker moves between them.

Recreating the full attack path can show when the first activity is detected, what the attacker accomplishes before and after that point, which controls interrupt the sequence and how long containment takes. Repeating these scenarios as tools and threats change can reveal whether the gap between access and intervention is narrowing—or growing.

That approach also gives teams a chance to fix weak points before a real incident exposes them. It aligns with preemptive security: anticipating plausible attacker actions and addressing the conditions that enable them before those actions begin.

Reduce the ground an attacker can cover

EvilTokens is an early example of cybercriminals applying AI to established methods, as Microsoft’s takedown has highlighted. Tools that help criminals handle more targets, move faster and operate with less expertise are likely to attract further use. That makes historical response benchmarks less reassuring: a strong detection time matters less if an attacker can accomplish much more within it.

Defenders can’t dictate how quickly criminals adopt AI. They can test how attacks move through their own environments, close the paths that enable progress and improve containment. The practical goal is to leave an AI-assisted attacker less room to act before the incident is stopped.