# Microsoft shuts down AI scam platform that stole 12,000 accounts

> EvilTokens used an AI chatbot to automate email compromise and fraud at scale, forcing Microsoft to take down 50 websites.
- Title: Microsoft shuts down AI scam platform that stole 12,000…
- Summary: EvilTokens used an AI chatbot to automate email compromise and fraud at scale, forcing Microsoft to take down 50 websites. AI-powered attack platforms can…
- Keywords: microsoft, eviltoken, ai chatbot, account compromise, email fraud, oauth abuse, device code authentication, microsoft entra, cybercrime, account takeover, business email compromise, ai-assisted attacks
- Source: Ars Technica — https://arstechnica.com/security/2026/09/microsoft-disrupts-ai-assisted-platform-that-compromised-12000
- Published: 2026-09-22T19:45:47+00:00
- Read time: 1 min
- Topics: microsoft, eviltoken, ai chatbot, account compromise, email fraud, oauth abuse, device code authentication, microsoft entra, cybercrime, account takeover, business email compromise, ai-assisted attacks
## Microsoft disrupts AI scam platform
Microsoft shut down EvilTokens, a subscription service that used an AI chatbot to compromise 12,000 accounts across 10,000 organizations worldwide over several months.
## How EvilTokens worked
The platform charged $1,500 upfront and $500 monthly, then automated the entire attack: sending phishing emails, analyzing victim inboxes, identifying payment-authorized employees, and drafting convincing fraud messages.

> The platform could even recommend fraud strategies, including drafting messages that impersonated trusted contacts.
## AI analyzed inboxes in real time
EvilTokens used AI to analyze up to 5,000 compromised emails at a time, identifying employees with payment authority, their managers, and relationships that could be exploited for wire fraud.
## Exploited Microsoft's OAuth process
Attackers sent phishing emails with malicious links that triggered Microsoft Entra device code authentication, a legitimate process designed for TVs and devices without keyboards, to enroll attacker-controlled devices.
## Victims spanned six continents
The 12,000 compromised accounts belonged to organizations in the US, Canada, UK, Australia, India, and France across wholesale distribution, construction, finance, real estate, education, and healthcare.
## Microsoft seized 50 websites
Working with law enforcement and partners, Microsoft took down 50 websites and 150 domains operating EvilTokens. The UK Metropolitan Police arrested two men in connection with the platform.
## Minutes, not days to exploit accounts
Microsoft warns that compromised inboxes can now be fully analyzed and exploited in minutes rather than days. Organizations should verify payment changes through a separate trusted channel.

> Assume that once an inbox is compromised, criminals may understand its contents in minutes, not days.
## Key takeaway

AI-powered attack platforms can now compromise email accounts and identify fraud targets in minutes instead of days, making strong identity protection and payment verification critical.