Microsoft disrupts EvilTokens platform that hit 12,000 accounts
Original: Microsoft disrupts AI-assisted platform that compromised 12,000 accounts
Why This Matters
AI-assisted phishing-as-a-service dramatically lowers the skill barrier for large-scale business email compromise.
Microsoft led an industry-wide takedown of EvilTokens, a subscription-based criminal platform that used an AI chatbot to compromise 12,000 accounts across 10,000 organizations worldwide. Launched on Telegram in February 2026, it charged $1,500 upfront plus $500/month. Microsoft seized 50 websites and 150 domains; UK police arrested two men.
EvilTokens launched in February 2026 via Telegram, offering an end-to-end fraud service for $1,500 upfront and $500 per month thereafter. At its core was an AI chatbot that analyzed victims' inboxes, identified high-value targets — payment authorizers, executives with financial authority — and drafted convincing impersonation emails designed to trick employees into transferring funds. Microsoft said the platform compressed what once took days into minutes.
The 12,000 compromised accounts spanned 10,000 organizations. The US had the highest concentration of victims, followed by Canada, the UK, Australia, India, and France. Targeted sectors included financial services, healthcare, real estate, construction, wholesale distribution, and higher education.
The technical entry point was device code authentication, a legitimate OAuth flow built for input-constrained devices like smart TVs. EvilTokens automated mass spam campaigns; recipients who clicked malicious links were directed to pages running hidden scripts that triggered real-time interactions with Microsoft Entra, generating device enrollment codes. Victims were then prompted to enter those codes into Microsoft's official login page — effectively handing attackers authenticated access.
Microsoft, working with SpyCloud and other partners, seized 50 websites and 150 additional domains tied to EvilTokens. The UK Metropolitan Police Service arrested two men in connection with the platform.