Microsoft Disrupts AI-Powered Phishing-as-a-Service Platform
Global operation takes down EvilTokens, a cybercrime service automating large-scale phishing attacks.
1AI-driven phishing at scale
EvilTokens operated as a phishing-as-a-service platform, compromising over 12,000 inboxes across 10,000 organizations worldwide. The service used AI to analyze compromised accounts, identify high-value targets, and generate tailored phishing messages. Automated attacks leveraged prebuilt templates, enabling large-scale business account breaches. Microsoft's investigation revealed the platform could summarize emails, map organizational roles, and recommend targets based on financial conversations.
2Multinational takedown operation
Microsoft's Digital Crimes Unit led a coordinated disruption involving Cloudflare, Coinbase, OpenAI, and law enforcement agencies. The operation seized 50 sites and disabled 150 domains in a single action. UK's Metropolitan Police arrested two suspects aged 32 and 38, seizing digital devices. The takedown required simultaneous action from hosting providers, exchanges, model providers, and data holders according to security firm SpyCloud.
3Sophisticated AI capabilities
EvilTokens' AI tools went beyond crafting convincing messages - they analyzed organizational structures, identified 'money movers,' and determined optimal impersonation targets. The platform could surface wire-transfer discussions and vendor invoices. Investigators found portions were 'vibe coded' with AI assisting platform development. The service combined identity attacks, cloud systems, and financial fraud into one interface, lowering the barrier for cybercriminals.
4Commercial cybercrime model
EvilTokens operated as a subscription service sold through Telegram for $1,500 initiation plus $500 monthly. It offered customer support, management dashboards, and tools guiding users from account access to financial exploitation. The platform packaged the entire fraud process - from initial compromise to final money extraction - into a turnkey solution, representing the professionalization of cybercrime.
5Global victim profile
Attacks primarily targeted wholesale distribution, construction, financial services, real estate, education, and healthcare sectors. The highest concentrations of compromised accounts were in the US, Canada, UK, Australia, India, and France. Stolen tokens sometimes granted attackers persistent access by registering new devices to victim accounts through authentication code interception.
6Investigative AI countermeasures
Microsoft's team used AI-powered tools and reverse engineering to analyze EvilTokens' infrastructure. Their investigation determined the platform drew capabilities from multiple AI models. This technical analysis enabled identification of supporting infrastructure and accelerated the takedown timeline. Microsoft shared intelligence with affected organizations and law enforcement for remediation.
7New era of AI cyberthreats
EvilTokens represents a paradigm shift where cybercriminals combine stolen access with AI that understands organizational workflows. Its capabilities to map relationships and recommend targets based on behavioral analysis signal a new sophistication in social engineering attacks. The platform's rapid growth demonstrates how AI lowers technical barriers for large-scale cybercrime operations.
8Collaborative defense imperative
The takedown highlights the necessity of cross-industry collaboration against evolving cyberthreats. Microsoft worked with tech partners, financial institutions, and law enforcement across jurisdictions. The case establishes a blueprint for disrupting similar services by simultaneously targeting multiple infrastructure components. It also underscores the need for organizations to monitor for token-based account compromises.
Original article: Slashdot — Microsoft Disrupts AI-Powered Phishing-as-a-Service Platform