Loading page…
The court-authorized operation removed infrastructure behind a service that Microsoft says turned compromised email accounts into maps for impersonation and payment scams.
Listen to this story
Microsoft and partners dismantled EvilTokens after a U.S. court authorized the seizure of 50 operating websites and disruption of more than 150 related domains. The alleged service turned stolen inbox access into structured business-email-fraud campaigns, reportedly identifying payment workflows, decision-makers and impersonation targets. Microsoft linked it to over 12,000 compromised inboxes across 10,000-plus organizations since its February 2026 launch. The takedown removes infrastructure, but defenders still需要?
EvilTokens reportedly charged a $1,500 initiation fee plus $500 monthly for a packaged criminal workflow.
Attackers allegedly used device-code phishing; password resets alone might not remove access if sessions and tokens remain active.
Microsoft said the service analyzed inboxes for wire transfers, money movers and trusted contacts to impersonate.
Microsoft and a group of technology and law-enforcement partners have disrupted EvilTokens, an alleged cybercrime service that used an AI-style chatbot to turn compromised email inboxes into tailored fraud plans. The action seized 50 operating websites and disabled more than 150 associated domains under a U.S. court order.
Microsoft’s account describes a service built to automate the slow, investigative part of business-email fraud. Rather than merely helping an attacker draft a persuasive message, EvilTokens could analyze a victim’s mailbox, map organizational roles, surface payment conversations and identify trusted relationships. It could then recommend people to impersonate and targets for fraud.
The alleged entry point was a device-code phishing attack. Victims were tricked into entering an authentication code on Microsoft’s legitimate sign-in page, giving criminals access without handing over a password. Microsoft said that access could remain after a password reset if associated sessions and tokens were not also revoked.
Once inside, the service’s alleged value was speed and structure. A criminal who had obtained access no longer needed to manually sift through thousands of messages to find decision-makers, invoices or payment procedures. Microsoft said preset prompts could locate wire-transfer discussions, identify people who move money and suggest the best contacts to impersonate.
Microsoft said EvilTokens was sold through Telegram for a $1,500 initiation fee and a recurring $500 subscription. Investigators also found evidence that large parts of the platform had been built with AI assistance and that it drew on capabilities from multiple AI models. The service paired those tools with dashboards, support and fraud-focused features in what Microsoft characterized as a commercially run operation.
That packaging is central to the risk Microsoft identifies: expertise once spread across identity attacks, cloud systems, social engineering and financial fraud was presented through a ready-made interface. The company said the platform affected organizations across sectors including financial services, real estate, higher education, healthcare, construction and wholesale distribution.
The U.S. District Court for the Eastern District of Virginia authorized the disruption. Microsoft and Health-ISAC worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs against parts of the service, while Microsoft said it notified affected customers and helped remediate compromised accounts.
In the United Kingdom, Metropolitan Police arrested two men, ages 32 and 38, on September 11 on suspicion of offenses connected with the alleged EvilTokens operation. Both were released on police bail subject to conditions while the investigation continues. Microsoft called the case its Digital Crimes Unit’s first court-authorized action against an end-to-end AI-enabled cybercrime service.
Removing a service’s infrastructure does not remove the underlying playbook. Microsoft’s practical warning is that a compromised inbox may now be understood in minutes rather than days. Its advice is to use strong identity protections and independently verify requests to change payment information, redirect funds or approve unusual transactions through a trusted second channel.
Editorial analysis
EvilTokens is notable less for a novel way to steal access than for what allegedly came next: turning an inbox into a guided fraud workflow. Microsoft says the service linked account compromise, mailbox analysis and target selection in one subscription product. That can make a familiar security failure more consequential, because an attacker need not spend days learning who approves payments or which vendors matter. The key event to watch is whether the legal seizure and arrests meaningfully interrupt that packaged model, or merely displace it to new infrastructure.
Loading discussion...
Join the conversation
Explain where extra verification is worth the delay.
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.