Microsoft Shuts Down EvilTokens, AI Scam Platform Behind 12,000 Account Breaches

Microsoft said Tuesday it led an industry-wide takedown of EvilTokens, a subscription-based scam platform that used an AI chatbot to compromise 12,000 Microsoft accounts over several months.

Launched on Telegram in February, EvilTokens charged an initial $1,500 fee plus $500 monthly. It streamlined email account compromises, helped customers analyze inboxes, pick high-value targets, and draft convincing follow-up emails to trick employees into transferring funds.

Microsoft said the platform's AI-style chatbot could identify trusted relationships, payment authorizations, and sensitive responsibilities, and even recommend fraud strategies by impersonating trusted contacts.

The compromised accounts belonged to 10,000 organizations worldwide, mostly in the US, followed by Canada, the UK, Australia, India, and France. Victims spanned wholesale distribution, construction, financial services, real estate, higher education, and healthcare.

Microsoft seized 50 websites and 150 domains used to run EvilTokens. The UK's Metropolitan Police Service arrested two men on suspicion of offenses tied to the platform.

Account compromises exploited device code authentication, a legitimate OAuth process meant for TVs and input-limited devices.