Security
Microsoft takes down AI-powered platform behind 12,000 account compromises
An AI chatbot-driven scam service let criminals analyze inboxes and craft fraud strategies to infiltrate corporate accounts worldwide.
Ars Technica
Microsoft and industry partners have dismantled EvilTokens, a subscription-based criminal platform that weaponized artificial intelligence to orchestrate large-scale email account takeovers. The breach affected roughly 12,000 Microsoft accounts across 10,000 organizations in multiple countries.
How the scam worked#
EvilTokens, which launched on Telegram in February 2026, operated as a cybercriminal-as-a-service offering. Attackers paid an initial fee of $1,500 followed by $500 monthly subscriptions to access the platform's capabilities.
The service's core function was an AI chatbot designed to analyze victim inboxes and surface exploitable patterns. The system would flag trusted relationships, payment authorization workflows, and sensitive job responsibilities—essentially mapping out where fraud stood the highest chance of succeeding. The platform then generated impersonation messages mimicking those trusted contacts to pressure employees into redirecting company funds to attacker-controlled accounts.
Scale and targets#
The compromised accounts spanned 10,000 organizations globally, with the heaviest concentration in the United States. Other significantly affected regions included Canada, the UK, Australia, India, and France. Target industries ranged across wholesale distribution, construction, financial services, real estate, higher education, and healthcare.
The disruption#
Working with legal authorities and a network of security partners—including SpyCloud—Microsoft executed a coordinated takedown. The operation resulted in the seizure of 50 websites and 150 additional domains associated with the platform. The UK's Metropolitan Police Service arrested two men in connection with the criminal enterprise.
Technical method#
The attackers exploited a legitimate authentication mechanism called device code authentication, originally designed for input-limited devices like smart TVs. In this flow, a device presents a code that users enter on a separate browser-enabled device to complete login—a process the attackers weaponized at scale to gain illicit access to corporate accounts.
