Microsoft announced on Tuesday that it dismantled EvilTokens, a subscription service that exploited an artificial intelligence chatbot to compromise 12,000 Microsoft accounts within a few months. The platform launched via a Telegram channel in February and demanded an initial fee of 1,500 dollars followed by monthly charges of 500 dollars. EvilTokens automated the process of breaching email security by analysing victim inboxes to identify trusted relationships and sensitive financial responsibilities. The tool then generated realistic phishing emails impersonating colleagues to trick employees into transferring funds to criminal-controlled accounts. Microsoft stated the chatbot could recommend specific fraud strategies to maximise the success rate of these social engineering attacks.
This incident highlights how automated tools lower the barrier for cybercriminals to execute large-scale financial fraud with minimal human oversight. The speed at which the platform operated reduced the time required to breach accounts from days to minutes, allowing attackers to target thousands of victims before detection. The involvement of major cloud providers in disrupting such operations demonstrates a growing consensus that coordinated industry action is necessary to counter advanced threats.
