Microsoft dismantles AI-powered fraud platform EvilTokens
Scam service compromised 12,000 accounts using chatbot-driven email analysis
1Platform operation exposed
Microsoft revealed EvilTokens, a subscription-based cybercrime service that operated through Telegram since February 2024. The platform specialized in mass email account compromise, charging $1,500 initially plus $500 monthly. It automated multiple steps of account takeover, significantly lowering the technical barrier for fraudsters while increasing attack scale and efficiency.
2AI-driven target selection
The platform's core feature was an AI chatbot that analyzed compromised inboxes to identify high-value targets. It pinpointed trusted relationships, payment authorizations, and sensitive responsibilities where fraud would likely succeed. This automation reduced the time from account access to fraudulent transactions from days to minutes, according to Microsoft's investigation.
3Fraud strategy automation
EvilTokens went beyond basic account access by recommending specific fraud strategies. Its AI component drafted convincing messages impersonating trusted contacts, tailored to each victim's communication patterns. This level of personalization made the phishing attempts significantly more effective than traditional bulk campaigns.
4Business email compromise
The platform focused on business email compromise (BEC) attacks, where criminals impersonate executives or vendors to initiate fraudulent transfers. By analyzing organizational hierarchies and financial workflows, the AI could identify the most vulnerable points in a company's payment authorization chain.
5Attack scale revealed
Microsoft confirmed the platform compromised 12,000 accounts during its few months of operation. The subscription model allowed multiple criminals to access the same toolset, creating a multiplier effect on potential victims. This represents a shift toward crime-as-a-service models in cyber fraud.
6Industry-wide disruption
Microsoft led a coordinated takedown involving multiple security firms and law enforcement agencies. The operation targeted both the platform's infrastructure and its user base. Such collaborations are becoming essential as cybercriminal services increasingly operate across jurisdictions.
7Emerging threat landscape
EvilTokens demonstrates how AI lowers barriers to sophisticated cybercrime. The platform's success stemmed from combining automation with social engineering, making large-scale targeted attacks accessible to less technical criminals. This represents a significant evolution in fraud tactics.
8Defensive implications
The case underscores the need for enhanced email security beyond passwords, including multi-factor authentication and AI-driven anomaly detection. Organizations must prepare for AI-powered attacks that can analyze internal communications and mimic legitimate business correspondence with high accuracy.