Microsoft disrupts AI-assisted scam platform that compromised 12,000 accounts

<p>Microsoft announced on September 22, 2026, that it led an industry-wide disruption of a subscription-based scam platform that utilized an AI chatbot to compromise 12,000 Microsoft accounts over a few months.</p><p>The platform, named EvilTokens, was introduced via a Telegram channel in February and charged an initial fee of $1,500, followed by a recurring monthly charge of $500. EvilTokens provided a service designed to streamline the steps necessary to compromise email accounts on a large scale. The platform assisted users in analyzing inboxes, selecting targets with the highest potential payouts, and drafting follow-up emails that created realistic scenarios to deceive company employees into transferring funds to accounts controlled by attackers.</p><h2>Minutes, not days</h2><p>Microsoft stated, “While EvilTokens helped cybercriminals access email accounts, at the center of the service was an AI-style chatbot that could analyze a victim’s inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other circumstances where fraud was most likely to succeed. The platform could even recommend fraud strategies, including drafting messages that impersonated trusted contacts to help criminals trick victims into taking action.”</p>