Microsoft dismantles AI-powered EvilTokens fraud service
Cybercriminal platform exploited 12,000 accounts across 10,000 organizations using automated inbox analysis.
1Sophisticated fraud-as-a-service
EvilTokens operated as a subscription-based cybercrime platform charging $1,500 initially plus $500 monthly. It combined device-code phishing with automated inbox analysis to compromise Microsoft accounts. The service targeted business email accounts to extract payment details, organizational hierarchies, and trusted contacts. Microsoft reports the platform affected 12,000 accounts across 10,000 organizations globally before being disrupted.
2AI-driven inbox exploitation
The platform's AI chatbot could analyze up to 5,000 emails at once, identifying key financial personnel, their managers, and business partners. It specifically searched for employees authorized to approve payments and their reporting structures. This automation allowed criminals to bypass traditional detection methods that rely on static phishing patterns. The system could then generate believable payment diversion requests mimicking trusted contacts.
3Device-code authentication abuse
Attackers exploited Microsoft's OAuth device-code authentication, designed for TVs and limited-input devices. Victims were tricked into entering codes at legitimate Microsoft login pages, unknowingly granting access. SpyCloud found the platform used Node.js automation to generate dynamic device codes in real-time through Microsoft Entra. This approach helped evade detection systems looking for known phishing infrastructure patterns.
4Global law enforcement action
Microsoft's Digital Crimes Unit collaborated with international partners to take down the operation, seizing 50 websites and 150 domains. The UK's Metropolitan Police arrested two suspects linked to the platform. Targeted organizations spanned wholesale distribution, construction, financial services, real estate, education, and healthcare sectors. Most victims were in the US, followed by Canada, UK, Australia, India, and France.
5Fraud automation capabilities
EvilTokens automated multiple stages of business email compromise. After account takeover, its AI could draft convincing messages appearing to come from trusted contacts. The system recommended fraud strategies and reduced the time attackers needed to study organizational structures. This automation enabled rapid financial fraud by identifying payment approval workflows and vendor relationships within compromised accounts.
6Security implications
The case demonstrates how stolen mailboxes can become immediate fraud vectors rather than just security breaches. Microsoft warns criminals can understand inbox contents within minutes. Traditional identity protections alone proved insufficient against this sophisticated attack chain. The incident highlights the growing weaponization of AI in cybercrime, particularly for business email compromise schemes.
7Defensive recommendations
Microsoft advises organizations to implement secondary verification for payment changes and unusual transactions. Monitoring alone cannot prevent all fraud when attackers gain legitimate access. Companies should assume compromised accounts will be quickly weaponized. The case underscores the need for layered defenses combining identity protection, behavioral monitoring, and financial process controls.
8Evolving cybercrime landscape
EvilTokens represents a shift toward AI-powered cybercrime services that lower the technical barrier for financial fraud. Its subscription model and automation tools enabled less skilled criminals to conduct sophisticated attacks. The platform's success in compromising thousands of accounts demonstrates how attackers are leveraging legitimate cloud services and authentication mechanisms for malicious purposes.
Original article: TechSpot — Microsoft dismantles AI-powered EvilTokens fraud service