Microsoft announced the disruption of EvilTokens, a subscription-based cybercriminal platform that facilitated mass account compromises using artificial intelligence tools. The platform, which launched in February through a Telegram channel, charged users an initial $1,500 fee followed by $500 monthly subscriptions and streamlined the process of compromising email accounts at scale.
The platform’s core functionality centered on an AI-powered chatbot designed to analyze victims’ inboxes and identify high-value targets. The system could determine trusted business relationships, payment authorization patterns, and organizational hierarchies to maximize fraud success rates. It also generated convincing fraudulent messages impersonating legitimate contacts to manipulate employees into authorizing fund transfers to attacker-controlled accounts. Over a period of months, EvilTokens users compromised approximately 12,000 accounts belonging to 10,000 organizations globally, with the highest concentration in the United States. Secondary concentrations appeared in Canada, the United Kingdom, Australia, India, and France. Targeted sectors included wholesale distribution, construction, financial services, real estate, higher education, and healthcare.
The platform exploited a legitimate authentication mechanism called device code authentication, typically designed for devices with limited input interfaces. Attackers sent malicious emails directing users to websites containing hidden automation scripts that interacted with Microsoft’s identity provider to generate fraudulent device codes. When users entered these codes into Microsoft’s official login portal, attackers gained account access. The platform’s backend automation allowed the entire process to bypass traditional security detection methods.
Microsoft collaborated with industry partners and SpyCloud to disable the operation, seizing 50 websites and 150 additional domains associated with EvilTokens. The United Kingdom’s Metropolitan Police Service arrested two individuals in connection with the scheme. Microsoft emphasized that organizations should assume compromised inboxes can be fully analyzed by criminals within minutes rather than days, and recommended implementing strong identity protections, account monitoring, and independently verifying financial and authorization requests through separate communication channels.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI