Microsoft announced the disruption of EvilTokens, a subscription-based cybercriminal platform that utilized artificial intelligence to facilitate large-scale account compromises. The platform was introduced in February through a Telegram channel and operated on a pricing model consisting of an initial $1,500 fee followed by monthly charges of $500. EvilTokens provided a comprehensive suite of tools designed to streamline the process of compromising email accounts in bulk and conducting follow-up fraud operations.
The platform centered on an AI chatbot capable of analyzing victim inboxes to identify trusted contacts, payment authorization patterns, and organizational hierarchies. This functionality allowed criminals to identify targets most susceptible to fraud and generate convincing impersonation messages. According to Microsoft’s findings, EvilTokens users compromised 12,000 accounts belonging to approximately 10,000 organizations globally, with the highest concentration in the United States. Canada, the United Kingdom, Australia, India, and France also experienced significant numbers of compromises. Affected sectors included wholesale distribution, construction, financial services, real estate, higher education, and healthcare.
The account compromise methodology exploited device code authentication, a legitimate OAuth process designed for input-constrained devices such as televisions. Attackers sent spam emails with malicious links directing users to webpages containing hidden automation scripts. These scripts interacted with Microsoft’s identity provider in real time to generate device enrollment codes, which users were then tricked into entering on Microsoft’s official device login portal. The platform’s backend automation allowed the technique to function end-to-end while evading traditional security detection methods.
Microsoft, working with security firm SpyCloud and law enforcement partners, seized 50 websites and 150 domains associated with the operation. The United Kingdom’s Metropolitan Police Service arrested two individuals in connection with the platform. Microsoft emphasized that the incident represents a significant evolution in account compromise tactics, as AI tools substantially reduce the time criminals need to analyze organizational structures and identify high-value targets for fraud schemes.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI