Microsoft Disrupts AI-Powered EvilTokens Service Linked to 12,000 Hacked Inboxes
Microsoft disrupts AI-powered EvilTokens phishing service, impacting 12,000 inboxes.
Microsoft has taken down EvilTokens, an AI-powered phishing-as-a-service platform that compromised over 12,000 email inboxes across 10,000 organizations. The service used AI to analyze compromised inboxes, identify payment authorization capabilities, and map trusted relationships to facilitate complex financial fraud. The operation involved seizing 50 websites and disabling over 150 domains, with two arrests made in the UK.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonEvilTokens exploited compromised email credentials to gain persistent access to inboxes, then used AI to intelligently map trusted relationships and payment authorization workflows — dramatically amplifying the damage a single compromised account could cause. The root problem is a combination of weak or reused credentials, insufficient multi-factor authentication adoption, and a lack of anomalous login detection. This matters because attackers no longer need to brute-force systems manually; AI-assisted tooling allows them to scale targeted financial fraud at industrial speed. Organizations that do not monitor for unusual inbox access patterns or unexpected email delegation rules are effectively blind to this class of attack.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.