Microsoft Warning -- New And Widespread 2FA Code Attacks Confirmed
2026-04-08
Forbes
The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
The EvilTokens Phishing-as-a-Service platform uses AI, including large language models, to automate and personalize business email compromise (BEC) attacks. Since early 2026, it has enabled cybercriminals to compromise hundreds of Microsoft accounts daily, exfiltrate sensitive data, and evade detection, causing widespread financial and security harm globally.[AI generated]
Why's our monitor labelling this an incident or hazard?
The article explicitly mentions an AI-driven infrastructure automating phishing attacks that have already caused hundreds of compromises daily, indicating realized harm. The AI system's use directly leads to violations of security and unauthorized access, which constitutes harm to persons and organizations. Therefore, this qualifies as an AI Incident due to the direct and ongoing harm caused by the AI-enabled phishing campaign.[AI generated]