There is a new way to lose your email account, and it does not need your password. You type in a short code — the kind you already use to sign in to a smart TV — and a stranger is suddenly reading your messages.
What Microsoft shut down this week
Microsoft announced on Tuesday that it had taken down a criminal service called EvilTokens, which it says broke into more than 12,000 email inboxes at over 10,000 organisations worldwide. The company needed a court order in the United States and help from Coinbase, Cloudflare and other partners.
EvilTokens was not a virus. It was a kit sold through messaging apps to anyone willing to pay: ready-made fake sign-in pages, plus an AI helper that read a stolen mailbox and worked out who was worth tricking next. Steven Masada of Microsoft’s Digital Crimes Unit said it could even suggest fraud strategies, including messages impersonating people the victim trusted.
British police arrested two men, aged 32 and 38, on 11 September. Microsoft seized 50 websites and switched off over 175 internet addresses used by the service.
How typing a code can give away your account
When you sign in to Netflix on a smart TV, the TV shows a short code and asks you to type it on your phone, because typing a long password with a remote is miserable.
EvilTokens copied that arrangement, and put a criminal where the TV should be. The email looks ordinary: an unpaid invoice, a shared document, a voicemail waiting. The link opens a page styled like Microsoft’s or DocuSign’s, showing a code and an instruction: type this into the Microsoft sign-in page to confirm it is really you.
None of that is fake: the page and the code are genuinely Microsoft’s. What is fake is who started the sign-in, because the login being finished belongs to the criminal, not to you. You gave away no password. You approved a login, and that login was a stranger’s. Nothing was taken from you, and the code on your own phone never rang — two-step verification was not broken, it was walked around.
Why this matters to you
Your inbox is the master key to your online life. Bank alerts, delivery notices and every “forgot your password” link arrive there. Whoever reads your email can quietly reset your other accounts, and can write to your colleagues and family as though they were you.
The intruders covered their tracks with hidden rules that deleted or buried warning messages, so nothing looked wrong. Coinbase says the access they gained often outlived a password change. The organisations hit were in construction, finance, property, universities and hospitals.
Coinbase customers were among those harmed: no password was stolen, but people were tricked into sending cryptocurrency to addresses owned by scammers.
What you can do about it
- Never type a code that someone else sent you. A sign-in code belongs to whoever started the sign-in.
- If you are asked for a code, read what the page says you are connecting to. Microsoft’s real page asks you to confirm the app. If the name means nothing to you, cancel.
- Set up a passkey or a security key where your accounts allow it — your fingerprint, your face, or a small device you plug in. These only work on the genuine website, so they beat codes sent by text message.
- Check where your account is signed in: in your Microsoft account, open Security and review the devices, signing out anything you do not recognise. Gmail keeps the same list under Security.
- Look for inbox rules you did not create, because that is how these intruders hide. In Outlook: Settings, then Mail, then Rules. In Gmail: Settings, then Filters.
- If a supplier or colleague emails new payment details, confirm by phone using a number you already had — never the number in the email.
- If you already typed one of these codes, change your password, sign out of all devices, and delete any inbox rule you did not make.
Three things people get wrong
Myth: two-step verification means I am safe
Keep it switched on, because it stops most attacks. This one is different: nothing was taken from you. You approved a login yourself, on the real website.
Myth: my email is not worth stealing
A nearly empty inbox is still the key to everything else you own online, because that is where password resets land. A thief does not need anything valuable inside. They need the doorway.
Myth: changing my password will kick them out
A new password is worth doing, but it may not be enough: the intruder is holding a key, not your password. Sign out of all devices, remove any device you do not recognise, and delete rules you did not create.
What to watch for next
Coinbase says the people behind EvilTokens already planned to aim the same toolkit at Gmail and other login systems. When a service like this is taken offline, the recipe usually returns under a new name within weeks.
The emails will keep coming, dressed as invoices, shared documents and voicemail notices, because those are what people open. Each one depends on the same step, and that step is yours to refuse.
The one thing to remember
No real company will send you a code and ask you to type it into a website to prove who you are. A sign-in code is yours to start, never someone else’s to give you. If a stranger hands you a code, the login being finished is theirs — and the door it opens leads into your email.
Image credits: Account verification alert on a smartphone by Zulfugar Karimov, via Pexels, used under the Pexels License (free to use, no attribution required).