Microsoft announced Tuesday that it had led a coordinated disruption of EvilTokens, a subscription-based cybercriminal platform that leveraged artificial intelligence to facilitate mass account compromises. The platform, which was promoted through a Telegram channel in February, charged customers an initial fee of $1,500 with monthly recurring charges of $500 to access its streamlined attack infrastructure.
The EvilTokens service functioned as an end-to-end compromise platform designed to simplify and accelerate the process of gaining unauthorized access to email accounts at scale. The system featured an AI-powered chatbot capable of analyzing victim inboxes to identify trusted relationships, payment authorization patterns, and other vulnerabilities that could be exploited for financial fraud. The platform further assisted attackers by recommending specific fraud strategies and generating convincing messages that impersonated legitimate contacts to manipulate victims into initiating fund transfers to attacker-controlled accounts.
Operators of EvilTokens successfully compromised approximately 12,000 customer accounts belonging to roughly 10,000 organizations across multiple countries, with the United States representing the largest concentration of victims. Canada, the United Kingdom, Australia, India, and France also reported significant numbers of compromised accounts. Affected sectors included wholesale distribution, construction, financial services, real estate, higher education, and healthcare. In response, Microsoft seized 50 websites and 150 additional domains associated with the platform’s operations. The UK’s Metropolitan Police Service arrested two individuals suspected of involvement in operating the criminal infrastructure.
The compromise mechanism exploited a legitimate authentication method called device code authentication, typically designed for television sets and other devices with limited input capabilities. Attackers distributed spam emails containing malicious links that directed recipients to pages running hidden automation scripts. These scripts interacted with Microsoft’s identity provider infrastructure to generate device codes for enrollment, which users were then instructed to enter into official Microsoft portals. This technique effectively bypassed traditional security detection methods and automated the entire attack workflow.
Microsoft characterized EvilTokens as representing a significant evolution in account compromise tactics. The platform’s AI capabilities substantially reduced the time attackers traditionally required to analyze organizational structures and identify high-value targets for fraud schemes. The company advised organizations to assume that compromised email accounts could be analyzed for exploitation opportunities within minutes rather than days, emphasizing the importance of robust identity protections, enhanced monitoring systems, and independent verification of sensitive requests through separate communication channels.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI