4 days ago
Microsoft Dismantles EvilTokens AI Platform Behind 12,000 Account Compromises
Microsoft says it shut down a service called EvilTokens that helped criminals attack online accounts.
The service charged customers an initial fee and then a monthly fee.
It reportedly helped attackers choose victims and send convincing messages.
After entering an account, criminals could search the victim’s email for useful contacts and payment information.
An AI chatbot helped them decide who to impersonate and how to request money.
The criminals used fake emails and Microsoft’s real device-login system to gain access.
More than 12,000 accounts in six countries were reportedly affected.
Microsoft and its partners removed many websites and domains connected to the operation.
Police in the United Kingdom also arrested two men suspected of involvement.
Microsoft said EvilTokens operated as a subscription-based cybercrime service costing $1,500 initially and $500 monthly.
The platform reportedly helped attackers target victims, analyze inboxes, impersonate trusted contacts and redirect payments.
Microsoft said more than 12,000 accounts were compromised across the United States, Canada, United Kingdom, Australia, India and France.
Attackers exploited Microsoft’s legitimate device-code authentication system through malicious emails, automated scripts and attacker-controlled webpages.
Microsoft and partners took down 50 linked websites and more than 150 supporting domains; the Metropolitan Police Service arrested two men.
- Who
- Microsoft, its partners, the alleged EvilTokens operators and customers, and the Metropolitan Police Service.
- What
- A subscription-based cybercrime platform called EvilTokens was disrupted after reportedly helping compromise more than 12,000 accounts.
- Where
- Activity was concentrated in the United States, Canada, the United Kingdom, Australia, India and France.
- When
- EvilTokens reportedly appeared on Telegram in February and operated for several months; the articles do not specify the year.
- Why
- The platform allegedly automated account takeovers and used AI to support targeted financial fraud.
Key facts
- Platform
- EvilTokens
- Initial access fee
- $1,500
- Monthly fee
- $500
- Accounts compromised
- More than 12,000
- Linked websites removed
- 50
- Additional domains disabled
- More than 150
- Reported arrests
- Two men arrested by the Metropolitan Police Service on suspicion of related offences
Quotes
Microsoft
Technology company describing the AI-enabled cybercrime operation
“AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible”
firstpost.com
Sources
Related news
Anthropic Warns Claude Users of Malware-Stealing Login Sessions
AI-Fueled Fake Interviews Help Hackers Target Job Seekers
Anthropic Disrupts Alleged Russian and Chinese AI Campaigns
Researchers Used Claude to Reach OpenAI Internal Systems
CEO Impersonation Scams Exploit WhatsApp, Email and Teams
AI Assistants Turned Account Access Into OpenAI Code Breach
Five Men Held Near RAF Fairford Amid Suspected Terror Plot
Five Arrested Near RAF Fairford as Terror Investigation Continues
Man charged after Sikh teenager dies in Southall car collision
Essex Cricketer Robin Das Charged With Two Rape Counts
