- Published on
Microsoft disrupts AI-assisted platform that compromised 12,000 accounts
- Authors
- Name
- DeepHorus
Microsoft said Tuesday that it led an industry-wide disruption of a subscription-based scam platform that compromised 12,000 Microsoft accounts in a few months. The platform, EvilTokens, centered on an AI chatbot that automated account takeovers. Security firm SpyCloud assisted the operation, and UK police arrested two men.
EvilTokens appeared on a Telegram channel in February, charging $1,500 upfront and $500 monthly. It streamlined most steps for compromising email accounts in large numbers. Customers could analyze inboxes, pick targets offering the biggest payouts and draft convincing follow-up emails. Those messages tricked employees into transferring funds to attacker-controlled accounts.
Microsoft said the chatbot could analyze a victim's inbox and identify trusted relationships, payment authorizations and moments where fraud was most likely to succeed. It could even recommend fraud strategies and draft messages impersonating trusted contacts. Microsoft said the process took minutes, not days.
Users compromised 12,000 accounts belonging to 10,000 organizations worldwide, with the highest concentration in the US. Canada, the UK, Australia, India and France followed. Victims spanned wholesale distribution, construction, financial services, real estate, higher education and healthcare.
Using legal process and a partner network, Microsoft seized 50 websites and 150 domains used to run EvilTokens. The UK's Metropolitan Police Service arrested two men on suspicion of offences connected to the platform. The coordinated takedown reflects growing cross-border action against scam services.
Compromises were carried out through a legitimate OAuth process called device code authentication. The method is designed for televisions and other input-constrained devices that cannot perform normal log-ins. The device displays a code that the user types into a browser on another device, which then authenticates the session.
