Microsoft has dismantled the EvilTokens platform, an AI-powered service used to compromise 12,000 accounts across 10,000 organizations globally. The platform, which launched in February via Telegram, charged users an initial fee of $1,500 followed by a monthly subscription of $500.
The service utilized an AI chatbot to analyze compromised inboxes, identify high-value targets, and draft fraudulent emails. These messages impersonated trusted contacts to trick employees into transferring funds to attacker-controlled accounts. The platform could process 5,000 emails at once to map organizational structures.
Attacks were executed by abusing the OAuth device code authentication process, typically intended for devices without standard login interfaces. Malicious links directed users to a script that interacted with Microsoft Entra to generate authentication codes, which victims were then tricked into entering on a fake portal.
To disrupt the operation, Microsoft seized 50 websites and 150 domains. Additionally, the UK Metropolitan Police Service arrested two individuals linked to the platform. The highest concentration of affected organizations was in the US, followed by Canada, the UK, Australia, India, and France.
Victims spanned various sectors, including financial services, healthcare, construction, and higher education. Microsoft noted that the use of AI significantly accelerates the post-compromise phase, allowing attackers to understand inbox contents in minutes rather than days.
