Microsoft Shuts Down AI-Powered Scam Network Used to Target Thousands

Microsoft announced on Tuesday that it has led a major effort to shut down a subscription-based cybercrime platform called EvilTokens. This operation is a significant update to the company’s ongoing efforts to stop digital fraud. The platform, which first appeared on a Telegram channel in February, made it much easier for criminals to steal information from email accounts. According to Microsoft, the service was responsible for compromising 12,000 accounts across 10,000 different organizations worldwide in just a few months.

EvilTokens operated as a paid service, charging users an initial fee of $1,500 and a recurring monthly fee of $500. By paying this, criminals gained access to a tool that automated the steps needed to break into email accounts. Once inside, the platform used an artificial intelligence chatbot to help attackers analyze a victim’s inbox. This AI could identify important business relationships, payment records, and sensitive job responsibilities. It even helped criminals write realistic emails that looked like they came from trusted colleagues, tricking employees into transferring money to accounts controlled by the attackers.

Microsoft noted that the platform was designed to make fraud happen in minutes rather than days. The victims included a wide range of industries, such as financial services, healthcare, construction, and higher education. While the attacks affected organizations around the world, the highest number of compromised accounts were located in the United States. Other countries with significant numbers of victims included Canada, the United Kingdom, Australia, India, and France. SpyCloud, a security firm that helped with the investigation, provided further details regarding the affected organizations.

To stop the platform, Microsoft used a legal process to seize 50 websites and 150 additional domains that were being used to run the service. The company worked alongside a network of partners to ensure the platform could no longer function. In a related development, the UK’s Metropolitan Police Service arrested two men on suspicion of crimes connected to the platform. These arrests mark a major step in holding those behind the service accountable for their actions.

The method used to break into these accounts involved a process called device code authentication. This is a legitimate system designed for devices that do not have a standard keyboard or screen, such as smart TVs. In this process, the device shows a code, and the user is asked to enter that code into a web browser on a separate device, like a phone or computer, to log in. Criminals were able to abuse this system to gain unauthorized access to the accounts of unsuspecting employees.

This disruption highlights the growing danger of AI-assisted cybercrime. By using artificial intelligence to analyze data and create convincing messages, criminals can act much faster and more effectively than in the past. Microsoft’s quick action to identify and stop EvilTokens shows the importance of cooperation between technology companies and law enforcement agencies to protect users from these evolving threats. As digital security continues to be a top priority, experts emphasize that employees should remain cautious of unusual requests, even if they appear to come from people they know and trust.

While the immediate threat from EvilTokens has been removed, the case serves as a reminder that cybercriminals are constantly finding new ways to use technology to their advantage. Organizations are encouraged to review their security settings and ensure that their staff are aware of how these types of scams work. By staying informed and using strong security practices, businesses can better protect themselves against similar future attacks.