Microsoft leads disruption of AI-assisted scam platform that compromised 12,000 accounts

Microsoft said it led an industry-wide disruption of EvilTokens, a subscription-based scam platform that used an AI chatbot to compromise 12,000 Microsoft accounts over several months. EvilTokens charged an initial $1,500 fee and a recurring $500 monthly charge.

The platform automated key steps in mass compromises, including analyzing compromised inboxes, identifying high-value targets, and drafting follow-up emails tailored to trick employees into transferring funds to attacker-controlled accounts.

At the center of the service was an AI-style chatbot that could analyze a victim’s inbox to identify trusted relationships, payment authorizations, and sensitive responsibilities, and recommend fraud strategies. Microsoft said the platform could draft messages impersonating trusted contacts to deceive victims.

Victims included organizations in wholesale distribution, construction, financial services, real estate, higher education, and healthcare, with the highest concentration in the US, followed by Canada, the UK, Australia, India, and France.

Using a legal process and a network of partners, Microsoft seized 50 websites and 150 domains used to operate EvilTokens. The UK’s Metropolitan Police Service arrested two men on suspicion of offenses allegedly connected to the platform.

Account compromises were achieved through device code authentication, a legitimate OAuth process designed for TVs and input-constrained devices. EvilTokens automated the sending of spam and used a hidden automation script on a webpage to interact with the user’s Microsoft identity provider in real time to generate a code for enrolling an attacker-controlled device.

The platform analyzed up to 5,000 compromised emails at a time to identify employees authorized to disburse large sums of money, their managers, and scenarios under which they could be persuaded to transfer money into attacker-controlled accounts.

Microsoft said EvilTokens represents a major shift in mass compromises by automating post-compromise analysis and fraud orchestration, enabling criminals to understand compromised inboxes in minutes rather than days.