Microsoft Disrupts AI-Powered Platform Compromising Thousands of Accounts
Microsoft has disrupted an AI-assisted platform called EvilTokens that compromised over 12,000 customer accounts belonging to 10,000 organizations worldwide. The platform, which was introduced in February on a Telegram channel, charged users $1,500 for an initial fee and a recurring monthly charge of $500.
EvilTokens provided a streamlined service for compromising email accounts in large numbers, including analyzing inboxes, selecting targets, and drafting follow-up emails to trick company employees into transferring funds to attacker-controlled accounts. The platform's AI-style chatbot could even recommend fraud strategies and draft messages that impersonated trusted contacts.
According to Microsoft, the compromised accounts were located primarily in the US, with the next-largest concentrations in Canada, the UK, Australia, India, and France. Victim organizations included wholesale distribution, construction, financial services, real estate, higher education, and healthcare.
Using a legal process and a network of partners, Microsoft seized 50 websites and 150 more domains used to operate EvilTokens. The UK's Metropolitan Police Service also arrested two men on suspicion of offenses allegedly connected to the crime platform.