What EvilTokens teaches us about defending against AI-assisted attacks

Publisher excerpt From CSO Online

Cybercriminals don’t need AI to compromise an organization, but AI is making its way into classic attack methods and changing how quickly such attacks can progress. Tasks that once required attackers to manually sift through information and piece together how an organization operates can be accelerated by AI, reducing the time defenders have to detect and intervene. A recent example of this is EvilTokens, a phishing-as-a-service platform that helps attackers gain access to Microsoft 365 inboxes and then uses AI to analyze the environment to determine the most effective next steps. First identified in February 2026, EvilTokens exploits the device authorization grant flow of OAuth 2.0 to gain access to Microsoft accounts without having to create fraudulent login pages. After taking down Storm-2992, the threat actor believed to be behind the scheme, in September, Microsoft said the EvilTokens operation leveraged AI “at every step of the attack chain.” As AI removes more of the friction that slows attackers down, security will depend not only on how quickly teams respond to threats, but on how much an attacker can accomplish before they do. AI is removing friction from the attack lifecycle Most cyberattacks can be broadly viewed as progressing through three stages: access, expansion and impact. First, an attacker gains access to the environment, whether by stealing credentials, exploiting a vulnerability or socially engineering an employee. From there, they expand what they…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.