Microsoft has disrupted an AI-enabled cybercrime platform that allegedly helped attackers compromise more than 12,000 email inboxes across over 10,000 organisations worldwide.
Known as EvilTokens, the platform emerged in February 2026 and was offered to cybercriminals as a subscription-based service. Microsoft said the operation combined account compromise, email analysis, target identification and fraud preparation, allowing attackers to automate several stages of an online scam campaign.
The service was reportedly advertised through Telegram and charged users an initial fee of $1,500, followed by a monthly subscription of $500.
According to Microsoft, EvilTokens was particularly concerning because its AI capabilities went beyond generating phishing messages. Once attackers gained access to an email account, the system could analyse the mailbox to identify financial discussions, payment-related activity, trusted contacts and people with authority within an organisation.
The AI tools could then help attackers identify potential targets and prepare messages designed to impersonate trusted individuals and persuade victims to authorise payments or transfer funds.
How the platform operated
EvilTokens exploited Microsoft’s device-code authentication process, a legitimate sign-in mechanism intended for devices that may not have a conventional web browser.
Attackers would direct victims to Microsoft’s genuine authentication page and persuade them to enter a code supplied through a phishing campaign. Once the process was completed, attackers could obtain access tokens that allowed them to access the victim’s account without necessarily obtaining the person’s password.
Microsoft said the platform also included automated infrastructure designed to support phishing campaigns and make the attacks more difficult for conventional security systems to detect.
After gaining access, attackers could use the platform’s AI functions to search through compromised mailboxes and identify information that could be useful for business email compromise and financial fraud.
Microsoft’s threat intelligence team said the platform could also map organisational structures and identify users involved in financial or administrative processes.
India among countries affected
Microsoft observed EvilTokens-related activity in several countries, including the United States, Canada, the United Kingdom, Australia, India and France.
Organisations in sectors such as financial services, healthcare, real estate, construction, wholesale distribution and higher education were among those affected. Microsoft said the platform was linked to more than 12,000 compromised inboxes across over 10,000 organisations.
Microsoft takes action against infrastructure
Microsoft’s Digital Crimes Unit worked with industry partners and law enforcement agencies to disrupt the operation.
The company said it obtained court authorisation to seize 50 websites associated with EvilTokens and disable more than 150 additional domains supporting its infrastructure.
The UK’s Metropolitan Police Service also arrested two men, aged 32 and 38, in connection with the investigation. Microsoft said the suspects were released on police bail while the investigation continues.
Microsoft said the operation highlights how artificial intelligence is increasingly being incorporated into different stages of cybercrime. In the case of EvilTokens, AI was used not only to assist with phishing but also to analyse stolen information and help criminals identify opportunities for financial fraud.
The disruption has taken down infrastructure associated with EvilTokens, but Microsoft noted that similar techniques can continue to emerge as criminals combine phishing, compromised accounts and AI-based tools.
For users and organisations, security experts continue to advise caution around unexpected authentication requests, unfamiliar login codes and urgent requests involving payments or changes to financial details.
