Sunday 4 October 2026
Afternoon EditionRSS
ZOTPAPER

News without the noise

ZOTPAPER
Security

Microsoft disrupts EvilTokens, an AI-powered cybercrime platform that breached 12,000 accounts

Subscription-based service used an AI chatbot to automate email compromise and fraud, charging up to $1,500 upfront

By LineZotpaper
Published
Read Time2 min
Microsoft announced Tuesday that it led an industry-wide disruption of EvilTokens, a subscription-based scam platform that used an AI chatbot to compromise 12,000 Microsoft accounts over several months, marking a significant escalation in AI-assisted cybercrime.

EvilTokens, introduced via a Telegram channel in February, charged an initial $1,500 fee and $500 per month thereafter, offering a streamlined service for compromising email accounts at scale. According to Microsoft, the platform not only helped attackers access inboxes but also deployed an AI-style chatbot to analyze victims' communications, identify trusted relationships, payment authorizations, and sensitive responsibilities, and recommend fraud strategies.

“While EvilTokens helped cybercriminals access email accounts, at the center of the service was an AI-style chatbot that could analyze a victim’s inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other circumstances where fraud was most likely to succeed,” Microsoft said in a blog post. “The platform could even recommend fraud strategies, including drafting messages that impersonated trusted contacts to help criminals trick victims into taking action.”

The disruption, which involved collaboration across the cybersecurity industry, represents a focused effort to dismantle a new breed of crime-as-a-service that leverages generative AI to reduce the time required for account compromise from days to minutes. Microsoft did not disclose the full list of partners involved or the specific technical steps taken to disrupt EvilTokens, but the company emphasized that the takedown was the result of coordinated legal and technical actions.

The 12,000 compromised accounts highlight the growing threat of AI tools being weaponized by cybercriminals, where even relatively low-cost subscriptions can enable large-scale attacks on individuals and organizations.

§

Analysis

Why This Matters

  • The use of an AI chatbot to analyze inboxes and draft convincing phishing messages dramatically lowers the skill barrier for cybercriminals, potentially increasing the volume and sophistication of email-based fraud.
  • With 12,000 accounts compromised in just a few months, the incident demonstrates how subscription-based crime platforms can scale quickly, posing a direct threat to businesses and individuals relying on Microsoft accounts.
  • The disruption shows that tech companies and law enforcement are adapting to counter AI-enhanced threats, but the underlying business model may be replicated by other actors.

Background

EvilTokens is part of a growing trend of "crime-as-a-service" offerings that package hacking tools into easy-to-use subscription packages. While traditional phishing kits have existed for years, the integration of generative AI represents a new frontier: AI chatbots can now automate the social engineering phase, which has typically been the most labor-intensive part of account compromise. Microsoft has been increasingly vocal about the risks of AI misuse, and this takedown is one of the first high-profile examples of coordinated action against an AI-powered cybercrime platform.

Key Perspectives

Microsoft and cybersecurity industry: The takedown demonstrates that collaborative action can disrupt even novel AI-driven threats. Microsoft framed the operation as a necessary step to protect users and maintain trust in digital services. Cybercriminals and would-be attackers: EvilTokens showed that a relatively low investment ($1,500 upfront, $500/month) could yield access to thousands of compromised accounts, potentially inspiring copycat platforms or improvements to evade detection. Privacy and security advocates: The incident reinforces calls for stronger account security measures, such as multi-factor authentication, and for tech companies to proactively monitor for AI misuse on their platforms.

What to Watch

  • Whether Microsoft and partners release technical details of the disruption that could help other organisations defend against similar AI-powered threats.
  • The emergence of copycat platforms or variants of EvilTokens, particularly if the takedown only temporarily disrupts the service.
  • Regulatory and policy responses to AI-enabled cybercrime, including potential new requirements for AI model providers to prevent misuse.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workReport an errorSubscribe