Microsoft takedown of AI-driven scam service that hit 12,000 accounts

Microsoft takedown of EvilTokens AI scam service

Paragraph1: Microsoft announced on September 22, 2026 that it helped dismantle a subscription-based fraud platform called EvilTokens, which had been used to break into roughly twelve thousand Microsoft accounts belonging to about ten thousand organizations worldwide. The service first appeared on a Telegram channel in February of the same year and charged an upfront fee of fifteen hundred dollars followed by a monthly payment of five hundred dollars.

How EvilTokens bundled credential theft steps

Paragraph2: EvilTokens bundled several steps of a credential-theft operation into a single offering. Its core feature was an AI-powered chatbot that could scan a compromised mailbox, spot trusted contacts, pinpoint employees with authority to move money, and suggest convincing pretexts for fraud. The chatbot also drafted messages that mimicked legitimate senders, increasing the odds that victims would follow attacker instructions.

Paragraph3: The attackers abused the OAuth device-code flow, a method intended for devices without keyboards, such as smart TVs. Victims were lured to a page that ran a hidden script, which interacted with Microsoft Entra in real time to generate a device code. The code was then presented to the user with instructions to enter it on the official Microsoft login portal, granting the attacker a session token. Because the backend used custom Node.js logic, the activity evaded typical signature-based defenses.

How EvilTokens let criminals move from inbox to fund transfer in minutes

Paragraph4: Microsoft said the platform allowed criminals to move from inbox access to fraudulent fund transfers in minutes rather than days. By automating the analysis of thousands of emails at once, EvilTokens quickly built maps of organizational hierarchies, identified suppliers and customers, and highlighted the most lucrative targets. Victims spanned industries including wholesale distribution, construction, finance, real estate, higher education, and healthcare, with the greatest concentration in the United States, followed by Canada, the United Kingdom, Australia, India, and France.

Microsoft seizes websites domains in EvilTokens takedown

Paragraph5: To disrupt the operation, Microsoft coordinated with industry partners and used legal processes to seize fifty websites and one hundred fifty domains linked to EvilTokens. The United Kingdom’s Metropolitan Police Service arrested two individuals suspected of involvement in the scheme. SpyCloud, a security firm that assisted in the takedown, published additional details about the affected organizations.

How organizations should respond to mailbox breach after EvilTokens

Paragraph6: Microsoft advises that organizations treat any mailbox breach as an immediate risk: attackers can glean useful information almost instantly. Strong identity protections and continuous monitoring remain essential, but companies should also verify any request to change payment details, redirect funds, or approve unusual transactions through a separate, trusted channel before acting. This extra verification step can stop fraud even if an account has already been compromised.

We must keep same length (word count similar). Hard to exactly match, but we can approximate. We'll try to keep similar word counts per paragraph.

Paragraph1: "Microsoft announced on September 22, 2026 that it helped dismantle a subscription-based fraud platform called EvilTokens, which had been used to break into roughly twelve thousand Microsoft accounts belonging to about ten thousand organizations worldwide. The service first appeared on a Telegram channel in February of the same year and charged an upfront fee of fifteen hundred dollars followed by a monthly payment of five hundred dollars."

Count words: Let's count manually.

Microsoft(1) announced2 on3 September22,20264 that5 it6 helped7 dismantle8 a9 subscription-based10 fraud11 platform12 called13 EvilTokens,14 which15 had16 been17 used18 to19 break20 into21 roughly22 twelve23 thousand24 Microsoft25 accounts26 belonging27 to28 about29 ten30 thousand31 organizations32 worldwide.33 The34 service35 first36 appeared37 on38 a39 Telegram40 channel41 in42 February43 of44 the45 same46 year47 and48 charged49 an50 upfront51 fee52 of53 fifteen54 hundred55 dollars56 followed57 by58 a59 monthly60 payment61 of62 five63 hundred64 dollars65.

So ~65 words.

Paragraph2: "EvilTokens bundled several steps of a credential-theft operation into a single offering. Its core feature was an AI-powered chatbot that could scan a compromised mailbox, spot trusted contacts, pinpoint employees with authority to move money, and suggest convincing pretexts for fraud. The chatbot also drafted messages that mimicked legitimate senders, increasing the odds that victims would follow attacker instructions."

Count: EvilTokens1 bundled2 several3 steps4 of5 a6 credential-theft7 operation8 into9 a10 single11 offering.12 Its13 core14 feature15 was16 an17 AI-powered18 chatbot19 that20 could21 scan22 a23 compromised24 mailbox,25 spot26 trusted27 contacts,28 pinpoint29 employees30 with31 authority32 to33 move34 money,35 and36 suggest37 convincing38 pretexts39 for40 fraud.41 The42 chatbot43 also44 drafted45 messages46 that47 mimicked48 legitimate49 senders,50 increasing51 the52 odds53 that54 victims55 would56 follow57 attacker58 instructions59.

~59 words.

Paragraph3: "The attackers abused the OAuth device-code flow, a method intended for devices without keyboards, such as smart TVs. Victims were lured to a page that ran a hidden script, which interacted with Microsoft Entra in real time to generate a device code. The code was then presented to the user with instructions to enter it on the official Microsoft login portal, granting the attacker a session token. Because the backend used custom Node.js logic, the activity evaded typical signature-based defenses."

Count: The1 attackers2 abused3 the4 OAuth5 device-code6 flow,7 a8 method9 intended10 for11 devices12 without13 keyboards,14 such15 as16 smart17 TVs.18 Victims19 were20 lured21 to22 a23 page24 that25 ran26 a27 hidden28 script,29 which30 interacted31 with32 Microsoft33 Entra34 in35 real36 time37 to38 generate39 a40 device41 code.42 The43 code44 was45 then46 presented47 to48 the49 user50 with51 instructions52 to53 enter54 it55 on56 the57 official58 Microsoft59 login60 portal,61 granting62 the63 attacker64 a65 session66 token.67 Because68 the69 backend70 used71 custom72 Node.js73 logic,74 the75 activity76 evaded77 typical78 signature-based79 defenses80.

~80 words.

Paragraph4: "Microsoft said the platform allowed criminals to move from inbox access to fraudulent fund transfers in minutes rather than days. By automating the analysis of thousands of emails at once, EvilTokens quickly built maps of organizational hierarchies, identified suppliers and customers, and highlighted the most lucrative targets. Victims spanned industries including wholesale distribution, construction, finance, real estate, higher education, and healthcare, with the greatest concentration in the United States, followed by Canada, the United Kingdom, Australia, India, and France."

Count: Microsoft1 said2 the3 platform4 allowed5 criminals6 to7 move8 from9 inbox10 access11 to12 fraudulent13 fund14 transfers15 in16 minutes17 rather18 than19 days.20 By21 automating22 the23 analysis24 of25 thousands26 of27 emails28 at29 once,30 EvilTokens31 quickly32 built33 maps34 of35 organizational36 hierarchies,37 identified38 suppliers39 and40 customers,41 and42 highlighted43 the44 most45 lucrative46 targets.47 Victims48 spanned49 industries50 including51 wholesale52 distribution,53 construction,54 finance,55 real56 estate,57 higher58 education,59 and60 healthcare,61 with62 the63 greatest64 concentration65 in66 the67 United68 States,69 followed70 by71 Canada,72 the73 United74 Kingdom,75 Australia,76 India,77 and78 France79.

~79 words.

Paragraph5: "To disrupt the operation, Microsoft coordinated with industry partners and used legal processes to seize fifty websites and one hundred fifty domains linked to EvilTokens. The United Kingdom’s Metropolitan Police Service arrested two individuals suspected of involvement in the scheme. SpyCloud, a security firm that assisted in the takedown, published additional details about the affected organizations."

Count: To1 disrupt2 the3 operation,4 Microsoft5 coordinated6 with7 industry8 partners9 and10 used11 legal12 processes13 to14 seize15 fifty16 websites17 and18 one19 hundred20 fifty21 domains22 linked23 to24 EvilTokens.25 The26 United27 Kingdom’s28 Metropolitan29 Police30 Service31 arrested32 two33 individuals34 suspected35 of36 involvement37 in38 the39 scheme.40 SpyCloud,41 a42 security43 firm44 that45 assisted46 in47 the48 takedown,49 published50 additional51 details52 about53 the54 affected55 organizations56.

~

Frequently asked questions

What is EvilTokens and what were its subscription fees?

EvilTokens was a subscription-based fraud platform that gave attackers access to roughly twelve thousand Microsoft accounts across about ten thousand organizations worldwide. It charged an upfront fee of $1,500 and then a monthly payment of $500, first appearing on a Telegram channel in February 2026.

How did EvilTokens use an AI-powered chatbot to aid fraud?

The platform’s core feature was an AI-powered chatbot that could scan a compromised mailbox, identify trusted contacts, pinpoint employees authorized to move money, and suggest convincing pretexts. It also drafted messages that mimicked legitimate senders, making victims more likely to follow attacker instructions.

Which authentication flow did attackers abuse and how did it work?

Attackers abused the OAuth device-code flow, intended for devices without keyboards. They lured victims to a page running a hidden script that interacted with Microsoft Entra in real time to generate a device code. Users were told to enter that code on the official Microsoft login portal, granting the attacker a session token.

What steps did Microsoft take to disrupt EvilTokens and who assisted?

Microsoft coordinated with industry partners and used legal processes to seize fifty websites and one hundred fifty domains linked to EvilTokens. The UK’s Metropolitan Police Service arrested two suspects, and security firm SpyCloud helped with the takedown and published additional details about the affected organizations.

Source: Ars Technica