EvilTokens operation disrupted as 50 sites and 150 domains are seized
AI securityUnverifiedUpdated:
An AI-assisted scam platform that was reportedly used against 12,000 Microsoft accounts has had 50 websites and 150 domains seized, according to Microsoft.
Sites and domains seized through legal process
Microsoft said it led an industry-wide action against EvilTokens, a subscription-based platform that used an AI-style chatbot to analyze compromised inboxes, identify likely fraud targets, and draft impersonation messages. Microsoft said the operation used legal process and partners to seize 50 websites and 150 domains.
The UK Metropolitan Police Service also arrested two men on suspicion of offenses allegedly linked to the platform. Microsoft said EvilTokens users compromised 12,000 customer accounts across 10,000 organizations over several months.
EvilTokens was offered as a subscription service that reportedly streamlined large-scale email-account compromises and subsequent fraud activity.
Microsoft says it led an operation that seized 50 websites and 150 domains used to run EvilTokens, disrupting the platform’s reported operation.
From inbox analysis to fraud-message drafting
The reported platform combined account-compromise tooling with automated inbox analysis and message drafting. Microsoft characterized this as reducing the time needed to map relationships and payment roles within compromised mailboxes.
Sources
- Ars TechnicaMicrosoft disrupts AI-assisted platform that compromised 12,000 accountsRead source →