Cloudflare joins operation to disrupt EvilTokens phishing platform
UK announces National Centre for Information Defence to fight growing AI disinformation threat
CISO news
Cloudflare joins operation to disrupt EvilTokens phishing platform
loudflare’ s threat intelligence team has joined Microsoft and
C other partners in a coordinated operation to disrupt EvilTokens, a Phishingas-a-Service( PhaaS) platform used in Business Email Compromise campaigns.
EvilTokens emerged on Telegram in January 2026 and provided customers with a web-based platform capable of collecting authentication tokens used to access Microsoft 365 environments.
The service targeted authenticated sessions rather than relying solely on stolen passwords, potentially allowing attackers to circumvent Multi-Factor Authentication( MFA) protections and maintain access to compromised accounts.
EvilTokens also incorporated an AI coach providing guidance on Business Email Compromise, US tax documents and typical invoice and accounting correspondence.
Ercan Aydin, AVP, Middle East, Turkey & Africa at Cloudflare
Cloudflare’ s investigation found customers could provide their own Cloudflare API keys to configure Cloudflare Workers for collecting credentials and establishing phishing pages.
Cloudflare’ s Cloudforce One joined Microsoft’ s Digital Crimes Unit and other partners in an operation targeting the infrastructure.
Microsoft initiated civil legal proceedings to seize domains associated with EvilTokens, while Cloudflare blocked hundreds of domains, suspended associated accounts and disabled malicious Workers projects.
“ For organisations across the Middle East and Africa, the incident provides a broader reminder that cybercriminals are adopting the same automation and AI technologies that businesses use to improve productivity, but applying them to scale fraud and credential theft,” said Ercan Aydin, AVP, Middle East, Turkey & Africa at Cloudflare.
UK announces National Centre for Information Defence to fight growing AI disinformation threat
T he UK government is establishing a new National Centre for Information Defence to tackle disinformation and AI-enabled information attacks from hostile states, including Russia.
The Centre will bring together intelligence agencies, law enforcement and social media companies, with a remit to detect attribute and disrupt foreign information attacks, while helping communities build resilience to disinformation.
Announcing the Centre during his speech to the UN General Assembly in New York, Andy Burnham singled out Russia, citing the use of bots, fake websites, falsified newspaper articles and forged branding from British organisations as examples of tactics used to spread disinformation. He also warned that AI will significantly increase the scale of the threat.
Andrew Bud, Founder and CEO of iProov, said:“ The new National Centre for Information Defence will have an important role to play, but its success will depend on how quickly it can move from identifying threats to disrupting them.
“ Deepfakes are becoming too sophisticated and too scalable for the government to rely on individuals or platforms simply spotting fake content after the fact. The Centre should be looking at the infrastructure behind these attacks, including how we verify that the people, accounts and communications we interact with online are genuine.”
Elizabeth Anderson, CEO of the Digital Poverty Alliance, said:“ The Prime Minister’ s recognition that inequality can leave people more vulnerable to foreign influence is an important one, but we need to be careful not to frame this simply as a problem of individual susceptibility.”
10 WWW. INTELLIGENTCISO. COM