Microsoft says AI phishing service compromised more than 12,000 mailboxes

Microsoft says it helped dismantle an AI-powered phishing service that compromised more than 12,000 mailboxes across over 10,000 organisations. The company says criminals used the system to analyse stolen email and craft follow-up fraud, while two suspected operators were arrested in the UK.

Microsoft AI Watch analysis

What happened

Microsoft says its Digital Crimes Unit seized 50 websites linked to EvilTokens under a court order, with more than 150 additional domains deactivated. The company says the phishing-as-a-service platform was sold through Telegram and exploited device-code authentication: victims were tricked into entering a code on a legitimate Microsoft sign-in page, potentially giving attackers access even when two-factor authentication was enabled.

The service’s AI chatbot searched compromised mailboxes for useful details, including payment authority and active business transactions, then used that information to generate deceptive messages. Microsoft says the operation turned work that once took criminals days into tasks that could be completed in hours. Coinbase also helped investigate payment flows, according to the account carried by Yahoo News.

Why it matters

A compromised mailbox can become a map of who pays whom, which deals are under way and how to make a fraudulent request sound convincing. Automating that reconnaissance could make targeted scams faster to prepare and harder to spot. The reported figures describe Microsoft’s account of the operation, not a complete measure of every victim or loss.

Microsoft advises organisations to enable device-code authentication only where it is needed and to verify payment instructions through a separate communication channel. That second check is decidedly less futuristic than an AI phishing bot, which is rather the point.

Our read

The concrete warning is not that every phishing email is suddenly AI-generated. It is that attackers can use AI to turn stolen business context into more convincing, targeted fraud. Restrict device-code sign-in where practical, and make independent verification a rule for payment changes, not an optional hunch.

What to watch

• Whether Microsoft or investigators publish further details about affected organisations and losses.
• Whether law enforcement identifies the suspected operators or brings charges.
• Whether organisations tighten device-code sign-in and out-of-band payment checks.

Discussion spark: Should organisations make a second-channel check mandatory for every payment change, even when it slows routine business?

not affiliated with or endorsed by Microsoft