Microsoft announced on Tuesday that it spearheaded an industry wide effort to shut down a sophisticated scam platform called EvilTokens, which utilized artificial intelligence to breach approximately 12,000 accounts. Launched via Telegram in February, the subscription based service functioned like a toolkit for cybercriminals, charging an entry fee of 1,500 dollars followed by monthly payments of 500 dollars. The platform streamlined the complex process of hijacking email accounts and identifying high value targets within companies to maximize fraudulent payouts.
At the heart of the operation was an AI powered chatbot that acted as a consultant for hackers. Rather than manually combing through stolen data, attackers used the bot to analyze victims’ inboxes and pinpoint trusted relationships or payment authorizations. Once a vulnerability was found, the AI would suggest specific fraud strategies and even draft highly convincing emails that impersonated colleagues or supervisors to trick employees into transferring funds to criminal accounts.
The scale of the attack reached across ten thousand organizations globally, with a significant concentration of victims located in the United States, followed by Canada, the UK, Australia, India, and France. The breadth of targeted industries was vast, spanning from healthcare and higher education to construction and financial services. To dismantle the infrastructure, Microsoft worked with various partners and legal authorities to seize 50 websites and another 150 domains associated with the service.
Law enforcement also stepped in during the crackdown, with London’s Metropolitan Police Service arresting two men suspected of ties to the platform. Investigators discovered that EvilTokens gained access to these accounts by exploiting a legitimate authentication process intended for devices like smart TVs that cannot handle standard logins. By manipulating this device code system, scammers were able to bypass traditional barriers and gain unauthorized entry into corporate networks worldwide.