Research / Market tracker / Cybercrime Enforcement
TRM Labs supports Microsoft's EvilTokens cybercrime disruption
On September 22, 2026: TRM Labs reported supporting Microsoft's September disruption of EvilTokens, an AI-enabled phishing-as-a-service operation targeting Microsoft 365 authentication tokens and business email compromise victims. Cloudflare also documented its role in the coordinated action. It is tracked as a cybercrime enforcement move because TRM Labs published the primary source.
Source: TRM Labs
Get next week's moves first
Updated at least weekly on the site. Subscribers get the next set of verified moves by email with the monthly report.
Subscribe free