Storm-2992
- Profile updated
- 2026-10-02 03:00:04
Context
Financially motivated threat actor tracked by Microsoft Threat Intelligence as the developer and support operator of the EvilTokens phishing-as-a-service platform, advertised and sold to other cybercriminals through Telegram channels. Storm-XXXX is Microsoft's designation for a developing or emerging activity cluster: the name is provisional and may be merged or renamed once attribution matures. Its infrastructure was disrupted by Microsoft's Digital Crimes Unit with partners in September 2026.
Reports & references
- Microsoft — Unmasking Eviltokens Getting To The Root Of Device Code Phishing (report)