Microsoft Disrupts EvilTokens, an AI-Assisted Scam Platform Tied to 12,000 Compromised Accounts

The platform was introduced over a Telegram channel in February and sold its capabilities on a subscription basis, charging an initial fee of $1,500 and a recurring $500 charge each month after that, according to Ars Technica. EvilTokens offered buyers a single service that streamlined most of the steps required to compromise email accounts in large numbers.

According to Microsoft, the service went beyond providing access to inboxes. It also helped customers analyze them, select targets that would provide the biggest potential payouts, and draft follow-up emails that supplied realistic ruses for tricking company employees into transferring funds to attacker-controlled accounts.

Microsoft said the AI-style chatbot at the center of the platform could analyze a victim's inbox and help criminals identify trusted relationships, payment authorizations and sensitive responsibilities, "as well as other circumstances where fraud was most likely to succeed."

"The platform could even recommend fraud strategies, including drafting messages that impersonated trusted contacts to help criminals trick victims into taking action," the company said.

Microsoft's account of the disruption carried the heading "Minutes, not days." The company described the action as industry-wide but did not name the other organizations that took part.

The announcement came roughly seven months after EvilTokens first appeared on Telegram and followed a few months in which the platform was used against Microsoft accounts. Microsoft put the number of compromised accounts at 12,000.