The Phishing Kit Cost $2,000. The Average Loss: $123,005.

A phishing service that Microsoft disrupted this week sold for $1,500, plus $500 a month. According to Microsoft, it was used to break into more than 12,000 inboxes at more than 10,000 organisations in seven months.

The average business email compromise reported to the FBI last year cost the victim about $123,000.

Microsoft's Digital Crimes Unit and its threat intelligence teams published their account of the platform, called EvilTokens, on 22 September, alongside a coordinated takedown of the infrastructure behind it.

What the money bought

EvilTokens was sold as a service, advertised and supported through Telegram channels, with the seller tracked by Microsoft as Storm-2992. The price was $1,500 to buy in and $500 a month to keep the kit and its control panel. Extras, including a redirector to filter out security scanners, bulk senders and a capture link, cost more for each 30 days.

Subscribers got 44 ready-made lure themes, among them invoices and requests for proposals, plus an AI assistant that wrote the phishing email to fit the target's role. Referring another criminal to the service earned a reward in cryptocurrency.

Why it defeated multi-factor authentication

The technique is device code phishing, and it works because the victim does the authenticating.

Device code sign-in is a legitimate flow built for screens that cannot handle a keyboard, such as smart TVs and conference room hardware. The device shows a short code, and the user types it into a browser somewhere else.

In the attack, the criminal's page asks Microsoft for a live code and shows it to the victim, often copying it to the clipboard automatically. The victim then goes to the genuine microsoft.com/devicelogin page and enters it, passing multi-factor authentication in the process. What they have actually approved is the attacker's session.

No password is stolen. No fake login page has to survive inspection. The only thing the criminal needs is for someone to paste a code within the 15-minute window, and the attacker's script checks every three to five seconds to see whether that has happened.

The part that concerns payments

Access to an inbox is not the goal. Microsoft's description of what happened next reads like a specification for invoice fraud.

The platform's AI filtered the pool of compromised users for people in financial, executive or administrative roles. It then used Microsoft Graph to map the organisation and its permissions. For the accounts with financial authority, the operators searched the mailbox for wire transfer details, pending invoices and executive correspondence.

Persistence was built to outlast the first alarm. In some cases attackers registered a new device within ten minutes of the breach to obtain a longer-lived token. In others they waited hours before creating inbox rules that hid their replies, the classic tell of a redirected payment.

Microsoft also warns of a gap that matters for any incident response run by a payments team: revoking a user's sessions typically invalidates refresh tokens but can leave existing access tokens working for up to an hour, which is why it advises temporarily disabling the account instead.

The arithmetic

Set the two numbers side by side.

Buying the kit and running it for a month cost $2,000. The FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025 with $3.05 billion in reported losses, which works out at about $123,005 per complaint.

One average success covers more than 20 years of the subscription. That is the economics that keeps phishing-as-a-service in business, and no takedown changes it.

What this is not

The victim counts are Microsoft's own telemetry and attribution, describing a platform used by many subscribers rather than the work of one gang. HaiPay could not independently verify them.

The FBI figures are victim-reported complaints, not a measure of all business email compromise, and they do not overlap with Microsoft's data. The per-complaint average is HaiPay's division of the FBI's reported losses by its complaint count, and is not a number the FBI publishes. Averages also hide a skew: a handful of very large cases pull the mean well above the typical loss.

News reports say arrests were made in the United Kingdom in connection with the service. HaiPay did not find a police statement confirming that today and does not report it as fact.

What to watch

Whether device code flow starts being blocked by default rather than by policy. Microsoft's own advice is to block it wherever it is not needed.

Whether the kit returns under another name. Phishing-as-a-service platforms usually do, and the price list is the clearest signal that demand is intact.

And whether payment controls catch what email controls missed. Every step in this chain after the token theft was a person reading invoices, which is exactly what payee verification and callback procedures exist to defeat.