Archive · 24 Sep 2026
Microsoft Dismantles EvilTokens AI Platform Behind 12,000 Account Compromises
Microsoft says it shut down a service called EvilTokens that helped criminals attack online accounts.
The service charged customers an initial fee and then a monthly fee.
It reportedly helped attackers choose victims and send convincing messages.
After entering an account, criminals could search the victim’s email for useful contacts and payment information.
An AI chatbot helped them decide who to impersonate and how to request money.
The criminals used fake emails and Microsoft’s real device-login system to gain access.
More than 12,000 accounts in six countries were reportedly affected.
Microsoft and its partners removed many websites and domains connected to the operation.
Police in the United Kingdom also arrested two men suspected of involvement.
Microsoft said EvilTokens operated as a subscription-based cybercrime service costing $1,500 initially and $500 monthly.
The platform reportedly helped attackers target victims, analyze inboxes, impersonate trusted contacts and redirect payments.
Microsoft said more than 12,000 accounts were compromised across the United States, Canada, United Kingdom, Australia, India and France.
Attackers exploited Microsoft’s legitimate device-code authentication system through malicious emails, automated scripts and attacker-controlled webpages.
Microsoft and partners took down 50 linked websites and more than 150 supporting domains; the Metropolitan Police Service arrested two men.
- Who
- Microsoft, its partners, the alleged EvilTokens operators and customers, and the Metropolitan Police Service.
- What
- A subscription-based cybercrime platform called EvilTokens was disrupted after reportedly helping compromise more than 12,000 accounts.
- When
- EvilTokens reportedly appeared on Telegram in February and operated for several months; the articles do not specify the year.
- Where
- Activity was concentrated in the United States, Canada, the United Kingdom, Australia, India and France.
- Why
- The platform allegedly automated account takeovers and used AI to support targeted financial fraud.
- Platform
- EvilTokens
- Initial access fee
- $1,500
- Monthly fee
- $500
- Accounts compromised
- More than 12,000
- Linked websites removed
- 50
- Additional domains disabled
- More than 150
- Reported arrests
- Two men arrested by the Metropolitan Police Service on suspicion of related offences