Summary
- Microsoft linked EvilTokens to more than 12,000 compromised inboxes across over 10,000 organisations, including substantial victim concentrations in the UK and France.
- The service combined device-code phishing with AI analysis of stolen mailboxes to identify payment relationships, trusted contacts, and fraud opportunities.
- UK police arrested two men on suspicion of offences connected with the alleged operation; both have been released on bail while the investigation continues.
Microsoft has disrupted infrastructure used by EvilTokens, an AI-assisted cybercrime service that combined account compromise with automated analysis of victims’ email to identify trusted relationships, payment processes, and opportunities for financial fraud.
Microsoft linked the service to more than 12,000 compromised email inboxes across over 10,000 organisations within months of its launch in February 2026. The highest concentrations of victim activity were recorded in the United States, Canada, the UK, Australia, India, and France.
The company and its partners seized 50 websites used by EvilTokens and disabled more than 150 additional domains tied to its supporting infrastructure. The operation combined civil legal action, technical disruption, private-sector cooperation, and work with law enforcement.
In the UK, the Metropolitan Police arrested two men aged 32 and 38 on 11 September on suspicion of offences connected with the alleged operation of EvilTokens. Both have since been released on police bail subject to conditions while the investigation continues. Their alleged involvement has not been established in court.
EvilTokens used device-code phishing to gain access to Microsoft accounts. Rather than obtaining a password directly, the technique could trick a victim into entering an authentication code through Microsoft’s legitimate sign-in process, granting the attacker account access.
Microsoft said that access could persist even after a password reset if associated sessions and tokens were not revoked. That shifts part of the response from the password itself to the wider session and identity state surrounding the compromised account.
The service then automated work that has traditionally required manual investigation by a criminal operator. Microsoft said EvilTokens could summarise and translate email, identify organisational roles, locate financial discussions, map trusted relationships, and surface people involved in authorising or moving money.
Preset prompts could identify wire-transfer discussions, vendor invoices, likely impersonation targets, and people involved in financial decisions. EvilTokens could also propose fraud strategies and help draft messages impersonating trusted contacts.
That shortens the distance between account compromise and business email fraud. Access to a mailbox is more valuable when an attacker understands the organisation around it — who approves payments, which suppliers are trusted, how invoices are discussed, and which requests are likely to appear credible.
Microsoft said EvilTokens was sold through Telegram for a $1,500 initiation fee and a recurring $500 subscription. Investigators also found evidence that AI had been used in developing significant parts of the platform itself.
The affected organisations spanned wholesale distribution, construction, financial services, real estate, higher education, and healthcare. Health-ISAC joined Microsoft’s legal action as a co-plaintiff, while Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, Shadowserver, and TRM Labs supported elements of the disruption.
The case shows how stolen identity can be converted into organisational intelligence at much greater speed. AI does not remove the need for initial access, but it can reduce the amount of human effort required to understand thousands of messages and turn them into a credible fraud plan.
Microsoft described the action as its Digital Crimes Unit’s first court-authorised disruption of an end-to-end AI-enabled cybercrime service. The infrastructure behind EvilTokens has now been disrupted, but the constituent techniques — phishing, stolen sessions, mailbox compromise, impersonation, and automated analysis — are not dependent on a single service.
