GoKawiilMicrosoft leads takedown of AI-driven EvilTokens phishing platform
Microsoft announced it coordinated an industry-wide disruption of EvilTokens, a subscription phishing service sold via Telegram since February that used an AI chatbot to help criminals analyze compromised inboxes and craft convincing fraud emails. The platform compromised 12,000 accounts across 10,000 organizations worldwide, mostly in the US, and Microsoft seized 50 websites and 150 domains as UK police arrested two suspects.
GoKawiil's interpretation of the reporting above, not reported fact.
The case shows how AI tools can lower the skill barrier for business email compromise scams by automating target selection and message crafting, according to Microsoft's description of the service. It suggests that as generative AI becomes embedded in cybercrime tooling, disruption efforts may increasingly require coordination between tech companies, security firms, and law enforcement across borders.
- EvilTokens compromised 12,000 Microsoft accounts across 10,000 organizations globally.
- The platform used an AI chatbot to identify fraud opportunities and draft impersonation emails.
- Microsoft seized 50 websites and 150 domains; UK police arrested two suspects.
YubiKey 5C NFC Security Key — With account-takeover scams like EvilTokens exploiting weak login protections, adding a hardware security key is one of the strongest defenses against phishing and credential theft. The YubiKey 5C NFC lets you enable phishing-resistant multi-factor authentication on Microsoft accounts and countless other services, making it far harder for attackers to hijack your inbox even if your password is stolen.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: arstechnica.com, 2026-09-22
Published there as: “Microsoft disrupts AI-assisted platform that compromised 12,000”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.