AI-Powered Phishing Service Hijacks 12,000 Inboxes for Financial Fraud
Written by AI from the linked story. Not reviewed by an editor. How this works
EvilTokens exploited compromised email credentials to gain persistent access to inboxes, then used AI to intelligently map trusted relationships and payment authorization workflows — dramatically amplifying the damage a single compromised account could cause. The root problem is a combination of weak or reused credentials, insufficient multi-factor authentication adoption, and a lack of anomalous login detection. This matters because attackers no longer need to brute-force systems manually; AI-assisted tooling allows them to scale targeted financial fraud at industrial speed. Organizations that do not monitor for unusual inbox access patterns or unexpected email delegation rules are effectively blind to this class of attack.
Tactical Insight
Immediate Actions
- Audit all email accounts for suspicious inbox rules, delegations, or forwarding configurations and remove unauthorized entries immediately.
- Enforce phishing-resistant MFA (e.g., FIDO2/passkeys) on all email and identity provider accounts across the organization.
- Reset credentials for any accounts showing anomalous login activity, unfamiliar IP geolocation, or impossible travel events.
Detection Measures
- Enable and review Microsoft 365 / Google Workspace unified audit logs for inbox rule creation, OAuth token grants, and mass email access events.
- Deploy a SIEM or CASB solution configured to alert on high-volume inbox reads, new mail forwarding rules, and logins from atypical locations or devices.
- Integrate threat intelligence feeds to detect known phishing-as-a-service infrastructure and block associated domains and IPs at the email gateway.
Long-Term Improvements
- Implement a Zero Trust email access model requiring continuous verification of device health, user identity, and session risk before granting inbox access.
- Conduct regular security awareness training focused on credential phishing, business email compromise (BEC), and recognizing fraudulent payment requests.
- Establish a formal incident response playbook specifically for email compromise scenarios, including rapid token revocation and forensic inbox review procedures.