Microsoft disrupts AI-assisted platform that compromised 12,000
ars ·
Microsoft has successfully disrupted EvilTokens, a subscription-based cybercrime platform that utilized AI to compromise 12,000 Microsoft accounts across 10,000 organizations. Launched in February via Telegram, the service charged users an initial fee of $1,500 plus monthly recurring costs to access its end-to-end attack capabilities. The platform employed an AI chatbot to analyze victim inboxes, identify high-value targets, and draft realistic phishing emails designed to trick employees into transferring funds. Attackers exploited the legitimate OAuth device code authentication process, automating the generation of dynamic codes to bypass traditional security detections. This automation significantly reduced the time required for criminals to map organizational structures and execute fraud, shifting the threat landscape from days to minutes. In response, Microsoft seized 50 websites and 150 domains associated with the operation and collaborated with partners like SpyCloud and the UK Metropolitan Police. Two men were arrested on suspicion of offenses related to the crime platform, marking a significant industry-wide disruption effort.
ars