Microsoft Shuts Down AI-Powered Scam Network

In a major move against cybercrime, Microsoft announced on Tuesday that it has successfully stopped a digital scam platform known as EvilTokens. This platform, which operated through the messaging app Telegram, used artificial intelligence to help criminals steal information from 12,000 Microsoft accounts. The operation affected 10,000 different organizations across the globe, making it a significant threat to international business security.

According to Microsoft, the EvilTokens platform was a subscription service. Criminals paid an initial fee of $1,500 to join, followed by a monthly payment of $500. Once inside, the platform provided tools to make stealing money much faster and easier. Instead of taking days to plan an attack, criminals could complete the process in just minutes. This disruption follows a recent global debate regarding the safety of artificial intelligence, where leaders and tech companies have been arguing about how to manage the risks of this powerful new technology.

At the heart of the EvilTokens service was an AI-style chatbot. Microsoft explained that this tool could read a victim’s private emails to find important information. The AI would look for trusted business contacts, payment details, and sensitive work responsibilities. By understanding these details, the AI could help criminals write realistic emails that looked like they came from a real coworker or partner. These messages were designed to trick employees into transferring funds to accounts controlled by the attackers.

Ars Technica reports that the victims of these attacks were located all over the world. While the highest number of compromised accounts were in the United States, many others were found in Canada, the United Kingdom, Australia, India, and France. The organizations targeted included a wide range of industries, such as financial services, healthcare, construction, and higher education. To stop the platform, Microsoft worked with a security firm called SpyCloud and used legal processes to take control of 50 websites and 150 different domains used by the criminals.

Regarding the legal consequences, the UK’s Metropolitan Police Service has arrested two men. They are suspected of being involved in the operation of the crime platform. Microsoft noted that the criminals gained access to accounts by using a process called device code authentication. This is a standard method meant for devices that do not have a full keyboard or screen, such as smart TVs. In this process, a user is shown a code and asked to type it into a web browser on another device. The criminals found a way to use this legitimate system to trick users into giving them access to their accounts.

This incident highlights a growing problem in the tech world. As AI tools become more advanced, they are also becoming more useful for people who want to commit crimes. By automating the process of analyzing emails and drafting fake messages, platforms like EvilTokens make it much harder for employees to tell the difference between a real business request and a scam. Security experts often warn that as technology improves, criminals will continue to find new ways to use it for their own gain.

For now, the disruption of EvilTokens is seen as a victory for digital security. However, the event serves as a reminder that organizations must remain very careful about how they manage their digital accounts. Microsoft’s quick action helped prevent further damage, but the case remains a clear example of why global cooperation between tech companies and law enforcement is necessary. As the debate over AI regulation continues, incidents like this will likely play a major role in how governments and companies decide to protect users in the future.