Microsoft disrupts AI scam platform

Microsoft shut down EvilTokens, a subscription service that used an AI chatbot to compromise 12,000 accounts across 10,000 organizations worldwide over several months.

How EvilTokens worked

The platform charged $1,500 upfront and $500 monthly, then automated the entire attack: sending phishing emails, analyzing victim inboxes, identifying payment-authorized employees, and drafting convincing fraud messages.

“The platform could even recommend fraud strategies, including drafting messages that impersonated trusted contacts.”

AI analyzed inboxes in real time

EvilTokens used AI to analyze up to 5,000 compromised emails at a time, identifying employees with payment authority, their managers, and relationships that could be exploited for wire fraud.

Exploited Microsoft's OAuth process

Attackers sent phishing emails with malicious links that triggered Microsoft Entra device code authentication, a legitimate process designed for TVs and devices without keyboards, to enroll attacker-controlled devices.

Victims spanned six continents

The 12,000 compromised accounts belonged to organizations in the US, Canada, UK, Australia, India, and France across wholesale distribution, construction, finance, real estate, education, and healthcare.

Microsoft seized 50 websites

Working with law enforcement and partners, Microsoft took down 50 websites and 150 domains operating EvilTokens. The UK Metropolitan Police arrested two men in connection with the platform.

Minutes, not days to exploit accounts

Microsoft warns that compromised inboxes can now be fully analyzed and exploited in minutes rather than days. Organizations should verify payment changes through a separate trusted channel.

“Assume that once an inbox is compromised, criminals may understand its contents in minutes, not days.”