Microsoft Disrupts AI-Powered Cybercrime Service EvilTokens

The Microsoft Digital Crimes Unit, along with Health-ISAC and a coalition of industry partners including TRM Labs, has disrupted EvilTokens, an AI-powered cybercrime service that used compromised email accounts to commit financial fraud.

EvilTokens packaged account takeover, mailbox analysis, target selection, and fraud preparation into a single commercial service, making it easier for criminals to exploit relationships and prepare complex financial scams.

TRM Labs supported the investigation with AI investigative capabilities and blockchain intelligence, helping map cryptocurrency activity tied to the EvilTokens ecosystem, trace funds toward downstream cash-out points, and identify elements of the financial infrastructure used by cybercriminals.