Microsoft Disrupts AI-Powered Cybercrime Service Linked to 12,000 Compromised Inboxes

Microsoft's Digital Crimes Unit has disrupted EvilTokens, an AI-powered cybercrime service that had compromised over 12,000 email inboxes across more than 10,000 organizations worldwide. The platform used artificial intelligence to analyze mailbox contents, identify organizational relationships, and locate financial information, making it a sophisticated tool for phishing and account compromise.

EvilTokens integrated multiple attack stages, including phishing, account compromise, mailbox reconnaissance, and fraud preparation, in a single commercial service. The platform's AI capabilities enabled it to process large volumes of email, identify high-value targets, and generate messages designed to impersonate trusted individuals or exploit existing business relationships.

The commercial structure of EvilTokens lowered the barrier to entry for cybercriminals, with an initial fee of $1,500 and a recurring subscription of $500. The service provided customers with a ready-made operational infrastructure, rather than requiring them to develop their own phishing and post-compromise capabilities.