Microsoft disrupts AI-assisted platform that compromised 12,000 accounts

Microsoft led an industry-wide disruption of EvilTokens, a subscription-based cybercrime platform that used an AI chatbot and automation to compromise roughly 12,000 Microsoft accounts tied to about 10,000 organizations. Launched via a Telegram channel in February, the service charged $1,500 up front and $500 monthly while providing end-to-end tools: bulk spam distribution, hidden automation that generated device codes in real time, analysis of inboxes, target selection, and AI-crafted impersonation emails. Using legal processes and partners, Microsoft and allies seized about 50 websites and 150 domains connected to the operation, and the UK Metropolitan Police arrested two suspects; security firm SpyCloud assisted in the takedown.

EvilTokens abused legitimate OAuth device-code authentication - interacting with Microsoft Entra - to enroll attacker devices when victims copied codes from malicious pages, a workflow that bypassed signature-based detection through complex backend logic. The platform could analyze about 5,000 compromised emails at once to map trusted relationships, payment authorizers, and management chains, enabling frauds that previously required days of reconnaissance in minutes. Victims spanned industries (distribution, construction, finance, real estate, higher education, healthcare) and countries (primarily the US, then Canada, UK, Australia, India, France). The key takeaway: inbox compromise now yields actionable intelligence almost instantly, so organizations must strengthen identity protections and verify payment or account-change requests via independent channels.