Microsoft says EvilTokens turned stolen inboxes into AI fraud maps

Microsoft says it disrupted EvilTokens, an AI-enabled cybercrime service that packaged stolen-mailbox access, inbox analysis and fraud planning into a commercial platform.

The Microsoft Digital Crimes Unit post says EvilTokens used AI across the attack chain, from analyzing compromised inboxes to recommending fraud strategies. Microsoft says the service had been linked to more than 12,000 compromised inboxes across more than 10,000 organizations, and that the company and partners seized 50 websites and disabled more than 150 additional domains tied to supporting infrastructure.

The important detail is what the AI was allegedly doing. Microsoft says EvilTokens could summarize and translate emails, identify trusted relationships, surface financial conversations and suggest who to impersonate. That moves the threat beyond better phishing prose. If a criminal already has mailbox access, an AI assistant can shorten the time between account compromise and a plausible payment-change request.

It was a service, not only a toolkit

Microsoft describes EvilTokens as a paid operation sold through Telegram for a $1,500 initiation fee and a recurring $500 subscription. The alleged product combined account compromise, mailbox scanning, target selection, customer support and dashboards. Investigators also found evidence, according to Microsoft, that large parts of the platform had been built with AI assistance and that the service drew on capabilities from multiple AI models.

That is why the case matters for defenders. Many organizations still treat business email compromise as a manual social-engineering problem: an attacker reads enough mail, learns the payment process and writes a convincing request. Microsoft's account suggests the workflow is becoming more industrial. The bottleneck shifts from reading and planning to getting reliable initial access and keeping sessions alive.

The disruption was legal and operational

Microsoft says Health-ISAC joined the civil action as a co-plaintiff because healthcare organizations were among the targets. The company also names Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, TRM Labs and UK law enforcement among the organizations involved in the coordinated response, and Cloudflare separately said it participated in the operation against EvilTokens phishing-as-a-service infrastructure. Microsoft says the Metropolitan Police Service arrested two men on September 11 on suspicion of offenses connected with the alleged operation; both were released on police bail while the investigation continues.

The practical takeaway is narrower than "AI cybercrime is here." Organizations should assume that a compromised inbox may be analyzed quickly enough to support believable fraud requests in minutes. Strong identity controls still matter, but Microsoft is pointing to a second failure mode: once access exists, payment workflows and vendor-change requests need independent verification through a trusted channel.

That distinction changes the defensive checklist. Resetting a password is not enough if active sessions and stolen tokens remain valid. Mailbox rules, OAuth grants, device-code sign-ins and suspicious forwarding behavior need review after compromise. Finance teams also need an operational rule that no urgent email alone can change bank details, approve unusual transfers or bypass normal procurement checks.

The case is also a reminder that defenders are using AI too. Microsoft says its investigators used reverse engineering and AI-powered tools to analyze evidence and identify infrastructure. That does not make disruption automatic, but it does show the same acceleration pressure on both sides of cyber investigations.